There are some applications that need to parse the timechain but don't need to verify signatures (they get the blocks from bitcoind), nor do they need to sign (they are not wallets). For these applications transitively depending on secp256k1 needlessly increases compile times and, if LTO is not used, also binary sizes. Examples of such applications are electrs and a new version of btc-rpc-proxy, which can fetch missing blocks from the peers but needs to verify their hashes.

It'd be really nice if secp256k1 could be optional to solve these issues. Is this something you'd accept a PR for? It's a breaking change but it can be trivially improved by semver trick (just pub use secp256k1::*;).