State minimization in MuSig2 signing sessions

[real-or-random]

@salvatoshi

If the colliding psbt is presented with mutated members that do not affect the output of NonceGen, then the changes in the second PSBT vs the first are irrelevant, as NonceGen would have been executed in with the same exact parameters if there was no mutation.

It seems to me that this is the unsafe case.

• The attacker sends you a PSBT
• You generate a secnonce and sign with it
• The attacker tells you that something went wrong, and sends you the same PSBT again with the same session_id
• So you generate the exact same secnonce and sign again with it

This is precisely what should not happen. Or why would this attack be prevented?