Just a thought on ways to deter all of this multiple spending gunk - when you start off, have a centralized bank server. While traffic is low, you can have each individual certificate cleared with the bank server upon creation and execution. As someone else noted, ``crypto is all economics''. In the New York City subway system, the new fare card readers are all linked to a central computer, specifically to prevent double spending. They could have used smart cards and fancy crypto -- but this is cheaper, especially because they have an excellent handle on the maximum load -- the number of subway riders at rush hour. Fancy technology could get them into an ``arms race'' with rip-off artists, who reverse-engineer cards, crack algorithms, etc. Digital cash -- which provide anonymity, as contrasted against cryptographically-signed debit card transactions -- will become a reality if and only if someone finds it more profitable than the alternative, after deducting the costs for observer chips, licenses for Chaum's patents, etc. Some people are willing to pay for privacy -- but are there enough of them to make it pay? --Steve Bellovin