>
> The exact same way you're proposing: via the payment protocol.
>

Ah, I see, that's what I was missing. So rather than have an explicit
repeated field for nonces, have an algorithm for extracting randomness from
one of the scriptSigs. I guess that makes sense.