starting with exculpability

doc/paper/taler.tex

@@ -1555,7 +1555,49 @@ protocol is never used.  Furthermore, if a customer needs to recover
 control over a coin using the linking protocol, they can use the
 refresh protocol on the result to again obtain an unlinkable coin.
 
+\section{Exculpability arguments}
 
+\begin{lemma}
+The exchange can detect and prove double-spending.
+\end{lemma}
+
+\begin{proof}
+\end{proof}
+
+\begin{lemma}
+Merchants and customers can verify double-spending proofs.
+\end{lemma}
+
+\begin{proof}
+\end{proof}
+
+
+\begin{lemma}
+Customers can either obtain proof-of-payment or their money back.
+\end{lemma}
+
+\begin{proof}
+\end{proof}
+
+\begin{lemma}
+If a customer paid for a contract, they can prove it.
+\end{lemma}
+
+\begin{proof}
+\end{proof}
+
+\begin{lemma}
+The merchant can issue refunds, and only to the original customer.
+\end{lemma}
+
+\begin{proof}
+\end{proof}
+
+
+
+\begin{theorem}
+  The protocol prevents double-spending and provides exculpability.
+\end{theorem}
 
 \end{document}