Hey @Daan, thanks for the feedback =)

After thinking it over a bit, this would probably not work because the payload’s hash would not match either in that case. It might be worth being explicit here that the hash is to be checked first, and then the size.

Yup, that's correct. Will make this more explicit.

So how does this play together with ssb’s current signing (and in the case of flume storage) format?

It doesn't. Every time I write up a format people assume it is about ssb =(

We'll probably end up using a modified version of bamboo for ssb, but in principle bamboo itself is a standalone protocol not connected to ssb.

Is that a typo?

Yes, will be fixed. It's my natural instincts that want to start at zero fighting against the fact that in this particular setting the math works out far better when starting at one.