XMSS WOTS+ private keys vs XMSS private keys The length of WOTS+ private key is an array of length &quot;len&quot; of n-Byte strings. Meaning, for w=16 and n=32, the len is 72. So the WOTS+ max length of the private key is 72, meaning only 72 messages can be signed.
Now my problem is, when you read about XMSS Keys, it says that the private key is defined by 2^h OTS private keys, h is usually 20 so 2^20 keys. What do I generate first? With the first definition I can only have 72 private WOTS+ keys and the second one extends it to over a milion.
Do I have to ignore the fact of array[len] n-Byte private keys and generate just 2^h WOTS+ keys using the chaining function?
Do I have to ignore the fact of array[len] n-Byte private keys and generate just 2^h WOTS+ keys using the chaining function?

In practice, what we do is follow the recommendations of section 4.1.11 of RFC 8391, and generate all the WOTS+ private keys dynamically as needed from a single secret seed.
The RFC recommends a two step process; you use the PRF function (with the ADR with the index of the WOTS+ key you're retrieving) to generate an n-byte value they denote as S_ots; then for each WOTS+ chain, you run the PRF function again on the S_ots value to generate the starting value for that chain.
And, if you're implementing XMSS^MT, you'll also want to pay attention to section 4.2.6, which adds a third layer to distinguish between different XMSS trees.  I suspect that step isn't needed (the ADR structure already distinguishes that); on the other hand, it's fairly cheap to follow the RFC's recommendations.