In ECDSA, the signature of number H is pair (r,s). Without knowing the private key and any signature made with the key, one can sign: 1. "random garbage" (there is some complicated structure in it) 2. H=0 3. H=r 4. H=s Is this known and/or trivial? Attached are some Sage example for bitcoin's curve SEC256k1. Would someone confirm or deny the examples with X=111 and unknown private key indeed work? Taking challenges: give the public key Q_A=(x,y) on the curve.