This is fascinating! I had no idea the nonce came from the private key, I thought it came from what was being signed. That definitely changes things because you can’t verify nonce without signing, as your point out.
Not your keys, not your coins Know your entropy Prove your signer’s nonce is deterministic …the list of things required to be using bitcoin correctly grows daily it seems :)