With a secret nonce r, commitment R = r·G, challenge e = H(R ‖ P ‖ m) and private key x, the signature is (R, s) with s = r + e·x mod n; the verifier checks s·G = R + e·P. It is the Fiat–Shamir transform of an identification protocol and is provably unforgeable under the discrete-logarithm assumption in the random-oracle model. Schnorr's patent kept it out of standards until it expired in 2008, which is why DSA and ECDSA were designed around it.
EdDSA is a Schnorr scheme on Edwards curves with deterministic nonces. Bitcoin's BIP-340 (activated with Taproot in November 2021) defines 64-byte Schnorr signatures over secp256k1 with 32-byte x-only public keys and tagged hashes; Nostr uses the same scheme.
Because signatures add up, n signers can produce one signature under one aggregate key: MuSig2 (BIP-327) for n-of-n and FROST (RFC 9591) for t-of-n. Compared with ECDSA there is no modular inverse, no s/n − s malleability once the encoding is fixed, and batch verification is cheap. The nonce rule is the same: reusing r for two messages reveals x.