For example if you

follow DSA's:

  k = G(t,KKEY) mod q

then you've leaked your x after a series of signatures, so you need to know
that you generate a large-than-required value before reducing mod q.  The
whole DLP family is just incredibly brittle, a problem that RSA doesn't have.