Cryptography, Blind Signatures, Google, VPN, Privacy.
pointing this out first. Okay, here’s why this doesn’t work… because any reconstructed r', from any BM and m values even if they are not correlated, will pass this check! Let’s work through it with example BM_1 that corresponds to m_1, and sig(h(m_2)), m_2 where m_1 != m_2: Signer knows: BM_1, d