Function endpoint_commitment 

pub fn endpoint_commitment(
    pk_nonce: &Nonce,
    endpoints: &[Element; 68],
) -> Digest

Public salt plus endpoint commitment, exactly ordered as upstream DSig.

BLAKE3(pk_nonce ‖ endpoint[0] ‖ … ‖ endpoint[67]): 16 + 68 × 18 = 1,240 input bytes, which is why the summary in crate counts 21 BLAKE3 compressions for the endpoint commitment. Signer and verifier both call this; a match proves the revealed nodes lead to this key’s endpoints.