BIP 54 mitigates the threat but does not provide sufficient protection.

It takes 1500s to verify a block down to 5s, which is still 500% worse than what most are used to in IBD so far.

We should be restricting scriptPubKey length. 520b was good, 34b is even better.