[323]

Even if you don't reuse keys you will be vulnerable the moment you do the first transaction - it will be the miner who sees your public key first. Even if you mine your own transactions you will be vulnerable, because the block could be orphaned, and anyone could then see your public key.

[NicolaiS]

In case Bitcoin needed to upgrade e.g. secp256k1, then a logical/easy way to avoid this problem is with a simple commitment scheme.