Apply suggestions from code review

Author: robwoodgate

00.md

@@ -95,11 +95,6 @@ A `Proof` is also called an _input_ and is generated by `Alice` from a `BlindSig
 
 `amount` is the amount of the `Proof`, `secret` is the secret message and is a utf-8 encoded string (the use of a 64 character hex string generated from 32 random bytes is recommended to prevent fingerprinting), `C` is the unblinded signature on `secret` (hex string), `id` is the [keyset id][02] of the mint public keys that signed the token (hex string).
 
-> [!NOTE]
-> A proof may optionally be extended by other NUTs. These include:
->
-> - [NUT-28][28]: Pay-to-Blinded-Key - adds `"p2pk_e": hex_str` to store an ephemeral pubkey
-
 ## 0.2 - Protocol
 
 ### Errors
@@ -282,11 +277,6 @@ If a short keyset ID resolves to more than one known full keyset ID, the identif
 
 The mint is unaware of the `s_id`. All API endpoints exposed by the mint use the full keyset ID.
 
-> [!NOTE]
-> The token format may optionally be extended by other NUTs. These include:
->
-> - [NUT-28][28]: Pay-to-Blinded-Key - adds `"pe": bytes` to individual proofs
-
 ##### Example
 
 Below is a TokenV4 JSON before CBOR and `base64_urlsafe` serialization.
@@ -357,4 +347,3 @@ utf8("craw") || utf8(<token_version>) || <serialised_token>
 [10]: 10.md
 [11]: 11.md
 [12]: 12.md
-[28]: 28.md

28.md

@@ -10,19 +10,17 @@
 
 This NUT describes Pay-to-Blinded-Key (P2BK), which extends the [NUT-11][11] (P2PK) spending conditions. By implication, it also extends [NUT-14][14] (HTLC).
 
-P2BK preserves privacy by blinding each NUT-11 receiver pubkey `P` with an ECDH-derived scalar `rᵢ`. Both sides can deterministically derive the same `rᵢ` from their own keys, but a third party cannot.
-
-This brings _"silent payments"_ to Cashu: Proofs can be locked to a well known public key, posted in public without compromising privacy, and spent by the recipient without needing any side-channel communication.
+P2BK preserves privacy by blinding each NUT-11 receiver pubkey `P` with an ECDH-derived scalar `rᵢ`. Both sides can deterministically derive the same `rᵢ` from their own keys, but a third party cannot. This improves user privacy by preventing the mint from linking multiple P2PK spends by the same party.
 
 ## ECDH Shared Secret (Zx)
 
-ECDH allows two parties to create an x-coordinate shared secret (`Zx`) by combining their private key with the public key of the other party: `Zx = x(epG) = x(eP) = x(pE)`.
+Elliptic-curve Diffie–Hellman (ECDH) allows two parties to create an x-coordinate shared secret (`Zx`) by combining their private key with the public key of the other party: `Zx = x(epG) = x(eP) = x(pE)`.
 
 For P2BK, the sender creates an ephemeral keypair (private key: `e`, public key: `E`). This protects the privacy of their own long-lived public key. They then calculate the shared secret by combining the ephemeral private key (`e`) and the receiver's long-lived public key (`P`).
 
-The receiver calculates the same shared secret using their private key (`p`) and the ephemeral public key (`E`), which is supplied by the sender in the [proof metadata](#proof-object-extension).
+The receiver calculates the same shared secret `Zx` using their private key (`p`) and the ephemeral public key (`E`), which is supplied by the sender in the [proof metadata](#proof-object-extension).
 
-This shared secret is then used to derive the blinded public keys.
+The shared secret `Zx` is then used to derive the blinded public keys.
 
 ## Deriving Blinded Public Keys
 
@@ -61,7 +59,9 @@ Finally, the public key (`P`) for slot `i` is blinded (`P'`) as follows:
 P' = P + rᵢG
 ```
 
-Here is a code example in TypeScript:
+### Example
+
+Below is an example implementation in TypeScript.
 
 ```ts
 function deriveP2BKBlindingTweakFromECDH(
@@ -105,7 +105,7 @@ Each proof adds a single new metadata field:
   "id": hex_str,
   "secret": str,          // still ["P2PK", {...}]
   "C": hex_str,
-  "p2pk_e": hex_str       // 33-byte SEC1 compressed ephemeral public key E
+  "p2pk_e": hex_str       // NEW: 33-byte SEC1 compressed ephemeral public key E
 }
 ```
 
@@ -118,7 +118,7 @@ Each proof adds a single new metadata field:
 
 With P2BK, the NUT-11 public locking keys are permanently blinded. The mint sees only the blinded public keys, and expects signatures from the corresponding private key.
 
-The receiver must therefore derive the correct blinded private key. Because BIP-340 lifts public keys to even-Y parity, there are two possible derivation paths:
+The receiver must therefore derive the correct blinded private key (`k`). Because BIP-340 lifts public keys to even-Y parity, there are two possible derivation paths:
 
 - Standard derivation: `k = (p + rᵢ) mod n`
 - Negated derivation: `k = (-p + rᵢ) mod n`