My understanding was that the size of the proofs was the primary hurdle to implementation. Is that true?
There were several other additional limitations:
* Very slow to validate (e.g. on the order of 1-2 tx per second)
* Required a trusted party to initiate the accumulator, and if they violate that trust they could steal coins
* Uses cryptography which is less well studied
* Only handled anonymized coins with one value, reducing the anonymity set size substantially
* Didn't conceal values
* Spent coins list is needed for validation and grows forever (e.g. no pruning of the critical validation state).
Of these only the first two and the last are probably real barriers, the others are more "doesn't work as well as some hypothetical future system might".
There was no way within their prior system to achieve size reductions to the currently mentioned,
I'd speculated in some other threads on some technology that could make the proofs smaller and faster, but if they've gone that route there may be some other consequences. It's hard to say much of anything useful without more information being made public.
I would note that the prior ZC implementation has been made available for some time now, and no altcoin has picked it up.
