Yes - so perhaps we should add XOR_A_with_B and XOR_B_with_A to the API (as these will be very easy to implement).
Sounds good, I'll do this right now.
Let's make them 0x0129 and 0x012a respectively (I'll update the spec shortly).
That could be avoided by hardcoding an address the messages must be received from. I do agree that it is a less desirable setup, but some may prefer having a higher level of security.
Unfortunately identifying "accounts" doesn't make much sense when it comes to Bitcoin clones (which is why no API functions to actually do this were created). So this would also be best provided with a "platform specific" API function though.
Having secrets being 16 bytes rather than 32 bytes is not a security concern IMO (so I think that would be the simplest portable solution).