BIP-340 Schnorr adaptor signatures · secp256k1
Add a secret to a pre-signature the real BIP-340 verifier rejects, and subtract the two signatures to read that secret straight back out.