There is a sentence pattern that only appears in bull markets. It goes like this: a demo shows how X and Y could do Z. Last week that sentence arrived in my feed attached to a project called PISA, and its subject was Bitcoin — a demo showing how Payjoin and CISA could shrink transactions on the base layer.
I read it three times. The first reading told me a project existed. The second told me a demo existed. The third told me the piece contained no byte counts, no transaction weights, no repository link, no BIP number, no named author, and no timestamp I could check against a mailing list. What it had instead was the word "could", repeated at a careful distance from anything measurable.
In 2020 I spent six hundred hours auditing the first Aave V2 interest-rate scripts by hand and found three logic errors. I found them because the code compiled and the numbers ran. A claim you cannot run is not a weaker claim — it is a different kind of object, and it belongs in a different drawer. The most revealing fact about the PISA announcement is not the demonstration. It is the absence of a number. That absence says more about Bitcoin's technical discourse in 2026 than any protocol diagram could.
So let me do the work the announcement declined to do: put the two components on the correct clocks, run the arithmetic nobody published, and ask what a demo like this would actually change if it shipped tomorrow morning.
Payjoin — BIP78, once called pay-to-endpoint — is a transaction-construction pattern, not a protocol upgrade. The receiver contributes at least one input of their own, so the transaction no longer reads as a single party paying a single party. Its purpose is specific and worth stating precisely: it attacks the common-input-ownership heuristic, the assumption that all inputs to a transaction share one owner. That heuristic is not a curiosity. It is the load-bearing assumption beneath nearly every commercial chain-analysis clustering algorithm in operation today. Break it cheaply and often, and a large share of the surveillance economy loses its footing.
Payjoin has been available since 2018. Adoption has sat in the low single digits for eight years. The reason is not that privacy is unpopular. The reason is that Payjoin asks for two things ordinary payments do not: interactivity, because the receiver must be reachable during construction or through an asynchronous store-and-forward layer, and money, because a Payjoin is materially heavier than the payment it replaces.
CISA — cross-input signature aggregation — is the opposite kind of object. Today each input carries its own witness signature. Under aggregation, several inputs of the same script type, or in the strongest form the same public key, could be covered by one signature. That is a consensus change. It needs a soft fork, which means a BIP, review, community consensus, miner signaling, and node upgrades. SegWit took until 2017. Taproot took until 2021. Writing Payjoin and CISA into a single sentence folds a wallet update measured in weeks into a protocol campaign measured in years.
When I translated Vitalik's Ethereum whitepaper into Portuguese in 2017 and bound eighty pages of commentary behind it, the lesson I took from handing out five thousand copies in Lisbon was not that good ideas win. It was that governance cadence decides what exists. Cleverness is cheap. Coordination is the scarce input.
Now the arithmetic. A one-input, two-output native SegWit payment weighs roughly 141 vbytes. A two-input, two-output Payjoin of the same script type weighs in the neighborhood of 222 vbytes. That is a premium of more than fifty percent over the payment it disguises, and the user pays it in fees, every time, for a benefit that is collective rather than personal. This is the honest economic explanation for a decade of disappointing adoption, and it is the penalty PISA claims to address.
A Schnorr signature under Taproot key-path spending occupies 64 witness bytes, and witness bytes are discounted to a quarter of their weight. Eliminate one signature per additional input and you save something on the order of 16 vbytes. Two hundred and twenty-two becomes roughly two hundred and six, against a baseline of one hundred and forty-one. PISA can shrink the Payjoin. It cannot make the Payjoin cheaper than the payment it replaces. Those are different sentences, and only the second one would justify the word "shrink" in a headline.
The gap that remains is real, and it is not closed by aggregation alone. Closing it requires output consolidation, batching, script simplification, or something else the announcement does not mention. If a demo genuinely beat the baseline, it was not demonstrating CISA. It was demonstrating something else wearing CISA's name.
There is a second constraint buried in the mechanism. Aggregation in its strongest form requires inputs of matching script type and, in the purest form, matching public keys. A wallet that wants to collect this dividend must actively consolidate matching UTXOs before spending. That is wallet engineering, not a protocol property — and the realized saving becomes a function of the user's UTXO history, which is precisely the variable users do not control. A deposit from an exchange, a legacy change output, a coin from a hardware wallet that never migrated: each one breaks the aggregation set and quietly returns the transaction to its heavier form.
Then there is the question of what a demo can even mean when CISA has no BIP number attached. Without an activation path, the demonstration runs in simulation or on a private signet. That is legitimate research. It is not reproducible on mainnet, and the missing repository link is the tell — not proof of bad faith, but proof that nobody involved expected an auditor to look.
And the bill. CISA changes sighash semantics, which changes witness structure, which changes wtxid commitments. Every light client, every bridge that watches for wtxid, every hardware wallet firmware that parses a signing payload, every fee estimator, every analytics parser inherits a migration cost. In a soft fork, the people who pay are almost never the people who benefit — that sentence belongs on the cover of every BIP ever written.
Which brings me to the quietest and most fatal issue. The benefit of CISA is a few satoshis per user, spread across millions of people who will never know it happened. The cost is concentrated in a small number of reviewers, node operators, and wallet maintainers who must coordinate for years. Diffused benefit plus concentrated cost equals permanent backlog. This explains CISA's dormancy better than any technical objection, and it explains a great deal about which proposals get oxygen in this ecosystem and which do not. Code is law, but ethics is soul — and the ethics here is precisely the part where somebody must pay a cost the market will not reimburse.
Now the pragmatism test. Suppose CISA activates in 2029 and PISA ships the following week. Does Payjoin adoption move? Not much, because the binding constraint was never bytes. It is the online requirement, and it is merchant integration. A payment processor that must keep a signing endpoint open per invoice absorbs an operational cost that dwarfs a few dozen satoshis of witness discount. Engineers optimize the variable they can measure, and the demo circuit rewards measurable variables. The unmeasurable one is a support ticket from a merchant whose endpoint timed out.
Go deeper and the framing unravels further. The surveillance that actually harms people is not denominated in weight units. It is the KYC-labeled deposit address at a custodian, which collapses clusters regardless of how elegantly the inputs were structured. A pristine Payjoin that touches a regulated on-ramp at one end protects almost nobody, while a boring ordinary transaction between two self-custodied parties leaks less than a sophisticated Payjoin inheriting a tagged change output. Byte-level optimization improves the region of the privacy surface where the industry has already made real progress, and leaves untouched the region where it is losing badly. Transparency, in the sense this industry usually means it — a dashboard, an explorer, a chart with a gradient — isn't the oxygen of trust. Verification is. A demo is not verification.
There is one more blind spot, and it is the largest. After the 2024 halving the subsidy stands at 3.125 BTC per block; in 2028 it falls to 1.5625. Bitcoin's long-run security budget leans on fees. Every efficiency gain — SegWit, Taproot, batching, and CISA if it ever activates — reduces fee revenue per unit of demand. For users today that is unambiguously good. For the 2032 epoch it is a structural question nobody wants to ask out loud, because the answer is uncomfortable and the asking is unpopular. A demonstration that shrinks transactions is also a demonstration that shrinks the security budget, and no bull-market announcement will ever place those two sentences in the same paragraph.
I will wait, and I will wait for three specific things: a repository I can clone, a table of measured byte counts against a stated baseline, and a BIP number with a mailing-list thread attached to it. Until those exist, PISA is a hypothesis wearing a headline, and the appropriate response is neither dismissal nor excitement but a quiet bookmark.
The harder question is not technical. A community that has chosen ossification as a virtue must occasionally prove it can still ship an upgrade that adds no new capability and merely makes existing things cheaper and quieter. If it cannot, then the answer to how Bitcoin scales privacy and efficiency will be written somewhere other than the base layer, by people who never waited for permission. Ask again in 2029.