code: def get_nonce(
      sk: Ed25519PrivateKey, data: bytes, ctr: int = 0
  ) -> Tuple[int, Ed25519PublicPoint]:
      
      # r = hash(hash(sk)[b .. 2b] + M + ctr)
      # R = rB
      h = _ed25519.H(sk)
      bytesize = _ed25519.b // 8
      assert len(h) == bytesize * 2
      r = _ed25519.Hint(h[bytesize:] + data + ctr.to_bytes(4, "big"))
      R = _ed25519.scalarmult(_ed25519.B, r)
      return r, Ed25519PublicPoint(_ed25519.encodepoint(R))
docs: Calculate CoSi nonces for given data.
      These differ from Ed25519 deterministic nonces in that there is a counter appended at end.
  
      Returns both the private point `r` and the partial signature `R`.
      `r` is returned for performance reasons: :func:`sign_with_privkey`
      takes it as its `nonce` argument so that it doesn't repeat the `get_nonce` call.
  
      `R` should be combined with other partial signatures through :func:`combine_keys`
      to obtain a "global commitment".