Purely random nonces fail catastrophically with a weak RNG; purely deterministic ones (RFC 6979, EdDSA) let an attacker who can induce a fault while the same message is signed twice compare the two outputs and recover the key, and they make some side-channel attacks easier because the nonce repeats exactly. Hedging computes the nonce as a PRF of the key, the message and fresh random bytes, so either input alone keeps it secret.
FIPS 204 makes hedged signing the default for ML-DSA: a 32-byte rnd from an approved RBG is hashed together with the key and the message, and the optional deterministic variant sets rnd to zeros; the same verifier accepts both (§3.4). For ECDSA, RFC 6979 §3.6 permits additional data in the derivation, BIP-340 recommends mixing 32 bytes of auxiliary randomness, and @noble/curves exposes it as extraEntropy.
Hedged signatures look like any other signature, so verifiers neither know nor care. What changes is the signer's failure profile, which is why hardware wallets and HSMs exposed to physical attacks prefer it.