Plus if you don't resuse addresses, pubkey isn't revealed and would require sha256 be broken. I think that's impossible really. There's no evidence to suggest breaking ECDSA is even possible.