Thanks for this. It's a great in-depth analysis with some useful conclusions. One thing I wish someone would look into is the actual cost to pull off an attack vs. payment value. Stated another way, how much would it cost to buy insurance on a transaction of a certain value for a certain number of confirmations. I think if you do the math, it's perfectly fine to take transactions of less than ~$1,000 with zero confirmations in most cases.