Nonces are a weakness of the frost system, Bitcoin uses deterministic nonces (at least for wsh, not sure about tr).
Deterministic nonces only help if you check them, and checking means signing the same transaction again on a second device and comparing the signatures.
RFC 6979 derives the nonce from your private key, so that second device now learns your entire seedphrase. That puts your secret on more devices, which works against the reason you bought a hardware wallet, and now you're trusting the second device as well. Almost nobody does this in practice, so you're still trusting one device to pick a good nonce.
In FROST no single device picks the nonce. Each signing device adds its own random nonce, and these combine into the final one. So long as just one single device is honest, the final nonce is random and none of them could have predicted it, so a compromised device can't steer it to hide data in the signature.
Keys work the same way: no device holds the whole private key, and no device controls the whole nonce. Several devices are always involved and they check each other as part of the protocol.
RFC 6979 derives the nonce from your private key, so that second device now learns your entire seedphrase. That puts your secret on more devices, which works against the reason you bought a hardware wallet, and now you're trusting the second device as well. Almost nobody does this in practice, so you're still trusting one device to pick a good nonce.
In FROST no single device picks the nonce. Each signing device adds its own random nonce, and these combine into the final one. So long as just one single device is honest, the final nonce is random and none of them could have predicted it, so a compromised device can't steer it to hide data in the signature.
Keys work the same way: no device holds the whole private key, and no device controls the whole nonce. Several devices are always involved and they check each other as part of the protocol.
1🤙1