schnorr signatures – Ought to a good Y coordinate be enforced after each key-tweak operation, or solely on the finish?

This can be a very area of interest query concerning BIP340 and key tweaking with even-only public keys.

I really feel my query could also be a matter of opinion, since there would not seem like an accepted proper / flawed option to do issues.

Key Tweaking

For instance that you just wish to apply a collection of tweaks to a secret key, and the returned key must have a good Y coordinate.

You’ve got two operations out there:

• [tweak] secret key (sec * tweak % N)
• [negate?] secret key (if pub(sec) == odd then sec * (N – 1))

You may apply the tweaks in two attainable methods:

• 1. [tweak], [tweak], [negate?]
• 2. [tweak], [negate?], [tweak], [negate]

Each options are legitimate, and can produce the specified key. Nonetheless, neither resolution is appropriate with the opposite, so all events should agree on which technique to make use of.

So what’s the accepted resolution right here? The primary resolution requires much less operations, however the second resolution may have some profit?

The idea of even-only public keys is comparatively new, so I am unsure what the clear consensus is right here.

Any suggestions could be drastically appreciated!