A Dive into the Math Behind Bitcoin Schnorr Signatures

Sort of.

Schnorr signatures have a "linearity" property -- if you add together two signatures you get a valid signature of the same text using the sum of the keys.

Sometimes you don't want people to be able to obtain signatures-with-the-sum-of-the-keys, or you don't want to enable bulk key-cracking via the same techniques that allow bulk validation.

Also, confusingly, "EdDSA" signatures (aka ed25519 signatures) are Schnorr signatures:

https://datatracker.ietf.org/doc/html/rfc8032#section-1

... however EdDSA:

1. Uses hashing instead of either multiplicative inverse (slow) or a source of randomness (footgun) for the nonce.

2. Hashes the public key into the signature in order to deliberately break linearity. Signatures with different keys will use different hashes, and hashing isn't linear, so adding the signatures no longer yields anything useful. The signature verifier checks this (they can, since they have your public key), so a defective implementation can't skip this step without producing bogus signatures.

Lol. Nice.