 First, the signer chooses a formula_5 pair which had not previously been used to sign any other message, and uses the one-time signature scheme to sign the message, resulting in a signature formula_25 and corresponding public key formula_21.To prove to the message verifier that formula_5 was in fact one of the original key pairs, the signer simply includes intermediate nodes of the Merkle tree so that the verifier can verify formula_13 was used to compute the public key formula_20 at the root of the tree.The path in the hash tree from formula_30 to the root be formula_31 nodes, call them formula_32, with formula_33 being a leaf and formula_34 being the root.