Requester has a message-hash
m that they want to be signed by pubkey
P that is owned by Signer (who knows
P = xG for private key
x and generator
The following is a direct adaptation of Matthew Green's blind scheme adapted for the specific case of bip-schnorr elliptic curve signatures (including the sign-flip factor) and has been used in the wild (for internal protocol message signing, not for transaction signing) since late 2019 in the BCH CashFusion protocol.
Gare elliptic curve points. Additive convention is used.
nis the curve order.
xare integers mod