Function sign_commit 

pub fn sign_commit<R>(
    config: &GenesisCeremonyConfig,
    key_package: &RootKeyPackage,
    artifact: &[u8],
    rng: &mut R,
) -> Result<(RootSigningCommitment, RootSigningNonces)>
where
    R: RngCore + CryptoRng,

Distributed signing — round one. Produce one signer’s PUBLIC commitment and SECRET nonces as two distinct artifacts, bound to the exact root artifact being signed. Run by each participating certifier against its own share. The caller MUST broadcast only the RootSigningCommitment and retain the RootSigningNonces locally (never share, archive off-host, or submit it) until sign_share. The artifact must be the bytes emitted by root_artifact_payload and is known before commitments are produced.