My question refers to the paper "Multi-user Schnorr security, revisited" by Bernstein. Does the implication shown in the paper
security of classic Schnorr $\implies $ multi-key security of key-prefixed Schnorr
apply to short Schnorr signatures?
By short Schnorr signatures I mean those of size $3k$-bit that you get by truncating the hash output bits by $k$.