How to 'attach' metadata to a bitcoin receive address I need to generate a receive address that is directly associated with some metadata, M, that forms part of a verifiable contract.

I require that customers can verify that an address really was generated from a specific contract message, but I do not want them to have the private key to the address.

I obviously don't want to bloat the blockchain nor do I wish to use non-standard transactions. P2SH is also not possible as it is still largely unsupported by many online wallet providers.

So here is my first attempt, based on (https://bitcointalk.org/index.php?topic=108423.0) ... 

# generate an EC key pair for the company
issuer_public_key = issuer_private_key * G

# create a contract message string, M
M = 'Terms of contract bla bla and also includes issuer_public_key for safety'

# generate a hash of the message
e = SHA256(M)

# create an EC point that is known to both parties
contract_point =  (e * issuer_public_key)

# generate a public key for this contract to form our receive address. Customer agrees to contract when they send BTC to receive address.
receive_public_key = contract_point + issuer_public_key

# the private key for the receive address is thus
receive_private_key = contract_point + issuer_private_key


Feedback much appreciated
That's all well and nice, but it turns out that courts aren't interested in "mathematical proofs" (with good reason).  I recommend reading all the books by Bruce Schneider.

Let's say you got someone to pay you at receive_public_key. Does that mean he has agreed to contract M? No.

The courts would still need to see documentation that your partner actually saw and agreed to the contract M. You could have emailed the guy and said "I'll give you $10 if you send Bitcoins to receive_public_key, then later claim that he agreed to contract M.

This same thing happened in the 90's, with vendors claiming cryptographic digital signatures had the property of Non-repudiation. But the courts disagreed. For example, someone can hold a gun to your head and make you 'sign' a contract (digital or otherwise). No court will consider that a valid contract, fancy math or no fancy math.