`FrostKey::mul_tweak`

[irriden]

If we ask signers to return s!(r1 + (r2 * b) + lambda * x * c * mul_tweak) in Frost::sign, we can get a signature that is valid for the public key s * mul_tweak * G.

Any multiplicative tweaks would have to be applied before any additive tweaks.

Let me know if you would merge a PR that implements this, thank you!