clarify nonce generation

[real-or-random]

• Separate nonce generation into getting a random byte string and converting it to a suitable scalar ...
• ... to make clear that the byte string can be generated differently.
• Make the warning a little bit more prominent and improve writing

[sipa]

ACK