Advantages of using intermediate hash over full hash in digital signature application
There are two points I can imagine where partial hashes in a protocol can be useful.
Massively parallel computing from the same start
Using an intermediate state as the base for the PoW seems to be standard practice with Bitcoin ASICs these days and give a few dozen per cent of a speed-up. Technically you can pre-compute what you want in the next block and then send this to the ASICs for them to do the final compression function call and looking for the right property.
Regulatory Restrictions / Trusted-Signed Data Displayment
There may be regulatory restrictions along the lines of &quot;the trusted computing device must have seen the actual transaction data&quot;, where the signature is over the sender, the recipient and the amount. Now the standard requires you to display the recipient and the amount on a card- / card-reader-controlled trusted display, however you could maybe save a bit of computation time by pre-computing the hash for the parts that do not need extra evaluation. Here the security gain would be in the fact that the card actually knows what it signed and not just some random blob (which could also have been a malicious transaction!).