This is kind of an academic question, but I wonder if it's possible to build an intentionally one-time signature scheme with elliptic curves?
I assume you could do it by supplying ECDSA with deterministic input instead of randomness during signing, resulting in "sudden death" if two messages are signed by the same key. This however includes all the complexity of ECDSA. I feel like there's probably a way to get one time signatures out of elliptic curves via some simpler construct.
(One-time-ness is normally an undesirable property, but imagine it's a desired property. You explicitly don't want multiple signatures per secret key, so you want to strongly discourage that by making it result in loss of security.)