## 6 Conclusions  
Let us start the conclusions by addressing Problem 1. We have shown that blind-signature schemes are _vulnerable_ to malicious implementation setups that invalidate privacy properties of blind signatures while being undetectable from the point of view of the Auditor. Subliminal channels exist in each one of the discussed protocols, and in case of a malicious, black-box implementation, allow for breaking the blindness property and for sending covert messages. We argue that these attacks are easily applicable in practice.  
Given that, we believe that blind-signature schemes should be implemented on the client side with great care. Answering the second part of Problem 1, we have presented a solution for preventing the aforementioned attacks in a pragmatic way. This problem can be solved by a properly implemented, transparent watchdog, provided the user can trust the watchdog not to collude with the client's device. This can be achieved by implementing the watchdog as a publicly auditable, open-source software. We have presented formal proofs of watchdog's effectiveness. The only remaining problem not solved by the watchdog is rejection sampling, which may still leak a few bits per signature. This is because the watchdog only stops the subliminal channels that are contained within the singing procedure, i.e., in values \((R,c,s)\) exchanged between \(\mathcal{D}\) and \(\mathcal{S}\), as per Theorems 1 and 2. Then, a subliminal channel can still exist in the unblinded signature \((c^{\prime},s^{\prime})\) or even in the signed message \(\mathsf{m}\) itself. While we do not have any solution that would not require modifying the schemes, we argue that, according to current knowledge (e.g., [27]), rejection sampling is in fact the only way to abuse the channel in the signature \((c^{\prime},s^{\prime})\) due to both of its random elements being a result of a one-way function of sorts. The anamorphic channel in \(\mathsf{m}\) can only exist in use cases where the signed message is a random value chosen by the device (e.g., a random token as in Privacy Pass [3]). It can only be stopped by carefully designing the implementation to not allow any randomness in messages. Having all of this in mind, watchdogs seem to be the optimal solution, especially given their transparency--there is no need to modify existing blind-signature implementations.  
For future work, similar analysis should be provided for other blind-signature schemes, e.g., blind RSA signatures, privately verifiable tokens based on verifiable oblivious pseudorandom functions (used in Privacy Pass) and post-quantum schemes. What is more, any work that improves rejection sampling will also improve the practicality of using it to break blind-signature schemes. Currently, one would require a large number of signatures to make it work (e.g., 50-100 signatures to establish a 256-bit Diffie-Hellman anamorphic key ak). Reducing this number to, say, 10 signatures could make the attack much more practical.  
Conceptualization, M.K. and O.S.; methodology, M.K. and O.S.; validation, M.K. and O.S.; formal analysis, M.K. and O.S.; investigation, M.K. and O.S.; writing--original draft preparation, M.K. and O.S.; writing--review and editing, M.K. and O.S.; visualization, M.K. and O.S.; supervision, M.K.; project administration, M.K. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
Not applicable.  
Data Availability Statement: Data is contained within the article.  
The authors declare no conflicts of interest.