bip138: exclude roots exposed by another expression

A root selected through a derived xpub can also appear bare or as a
literal key. Once a spend reveals it, anyone could decrypt the backup.
Exclude such cases.

bip-0138.md

@@ -114,8 +114,8 @@ hash construction from [BIP340](bip-0340.mediawiki#design).
 Because $s$ and $s_i$ use distinct domain-separation tags, $s \neq s_i$ and
 therefore $c_i$ is never the all-zero string.
 
-Keys published on chain are already kept out of $\{p_1, \dots, p_n\}$ by the
-[Descriptor key requirements](#descriptor-key-requirements).
+The [Descriptor key requirements](#descriptor-key-requirements) exclude
+keys exposed by literal or bare-xpub expressions in the backed-up scripts.
 Implementations MUST exclude the key with x coordinate
 `50929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0` (the BIP341 NUMS
 point). Applications MAY exclude any further key they know to be public.
@@ -172,14 +172,19 @@ does not reveal the individual participant keys. For encryption, use each
 participant's xpub root rather than the aggregate key. Literal public-key
 participants remain excluded.
 
+A candidate root MUST be excluded if its x-coordinate matches a literal key
+or a bare xpub root used outside `musig()` in any descriptor or resolved
+policy in the payload. For example,
+`wsh(or_i(pk(X/0/*),pk(X)))` exposes the root of xpub `X` on spending, so that
+root must be excluded even though `X/0/*` is otherwise eligible.
+
 Implementations:
 
 - MUST exclude every other form (literal pubkeys, bare xpubs outside `musig()`,
   ...) from $\{p_1, \dots, p_n\}$.
 - MUST refuse to encode a backup if the resulting set is empty.
-- MUST make the user aware of each excluded expression, since the
-  cosigner holding that key will be unable to decrypt the backup with
-  their key.
+- MUST make the user aware of each excluded expression and candidate root,
+  since its holder may be unable to decrypt the backup with that key.
 
 ### Key Normalization