Me too. I'm taking the naïve view that Elliptic Curve discrete logarithm problem having the same properties as discrete logarithm problem so the protocol should be implementable in ECC in its entirety, and I used logarithm syntax to represent elliptic curve "multiplication" in all documents I wrote; doing so doesn't mean I intend the actual exponent calculation to happen. The reason I remain curious about large on-chain exponent calculations is that there might be the need to involve traditional attestation issuers (like this one Victor proposed) but I wasn't expecting it as a condition for this protocol to work.