First Alice distrbutes keys (and ZKPs) to all parties. Each intermediate party can open their lock when the party to the right has opened theirs.
Try to do it in "one round".
Output (a+b) can either be spent by having the signature of A and waiting t or by having a multisig of A and B.
Alice and WT can collude to scam bob. Alice can spend output just after t. Bob would not be able to publish the penalty since the output is already spent.
(Change to previous approach: Penalty depends on output controlled by bob instead of alice)
Alice and Bob can collude to scam WT. Publish commitment + penalty right away. WT has racecondition on the revocation.
(Change to previous approach: Add timelock to the input of the penalty)
Alice and bob can collude to scam WT.
Alice and bob agree to spend earlier output (not by revocation) making the revocation TX invalid.Then Bob can publish the penalty TX and WT cannot do anything about it.
(Change to previous approach: Multisigs at outputs of commitment. Add timelock to bob's output -> cant send penalty right away (give WT time to react))
Alice and WT can collude to scam bob.
WT reclaims, Alice spends earlier tx.
Why assist to close honsetly?
If all watchtowers manage to collude to hold hostiles, they make profit.
However each one individually gains more money by following the protocol.
Parties can try to lock the collateral of the committee.
However if one of the parties has more money in the channel than each member of the committee, they lock more of their own money.
