This will make it easier to implement more evolved schnorr constructs such as blinded signatures and multisig.
R is public so it should be fine.
(technically, the jacobi index of Y is one additional bit of private information that is normally erased before publication, however this bit does not have a connection that can lead to compromise of private key since it is uncorrelated with the rest of the nonce)
jacobi symbol i mean
Interesting that this sign flip trick still works with MuSig. If signers produce an aggregate R that needs to have its sign flipped, then all signers can individually notice this, flip their k's, and thereby arrive at the proper result.
There was something bothering me about the way the k argument gets mutated here and I realized what it was... basically, if you were to call this function a second time with same variables, it may produce the wrong signature. In principle maybe you ought to flip the sign of R as well so that the caller learns the new corrected R.
But meh, as long as it's clear that k is expected to be cleared immediately after and no second call, it doesn't matter.
Should this also sanity-check the pubkey point argument (not point at infinity)?
Alternatively if sanity checks are not needed, this function can return void.
Seems fine overall, perhaps premature though, do you have an immediate need for these refactors?
It may also become useful to have Verify factored in a similar way, so that MuSig partial signatures can be verified / unit tested.