According to the paper “High-speed high-security signatures”…
Malleability. We also see no relevance of "malleability" to the standard definition of signature security.
Aside from the example, how is ed25519 malleable by the non-standard definition of signature security?
To be more specific:
I'd like to know about any malleability with signatures/keys. The example provided seems not to be a risk because the key must also change. If anything's been discovered since this paper, that would also be helpful. I'm concerned with ECDSA type malleabilities and wonder if there's anything “close”.