Cryptography, Blind Signatures, Google, VPN, Privacy.
mod N Divide by shared h(m): BM / h(m) = r^e mod N Raise by privkey d: (BM / h(m))^d = r^e^d mod N = r' So, the evil Signing Server and Redemption Point have reconstructed the secret nonce r (their guess is denoted as r'). They can now check if this r' actually corresponds to the original BM and m