Keys are encoded as the x-coordinate only, with the implicit even-y point, saving one byte. The challenge is e = tagged_hash("BIP0340/challenge", R.x ‖ P.x ‖ m) and the signature is R.x ‖ s; tagged hashes SHA256(SHA256(tag) ‖ SHA256(tag) ‖ data) separate uses of the hash. Recommended signing mixes 32 bytes of auxiliary randomness into nonce derivation, and verification is strict, so signatures are not malleable.
Linearity enables key aggregation (MuSig2, BIP-327) and threshold schemes (FROST), and batch verification speeds up block validation. BIP-340 messages are 32 bytes; arbitrary-length messages are covered by the later BIP-340 revision and by protocols that hash first (Nostr signs the 32-byte event id).