user139306: Per BIP-341, if you want to create a Taproot output that is only spendable via the script-path spend (and not a key-path spend), you must "pick as internal key a point with unknown discrete logarithm."
This requires using a nothing-up-my-sleeve (NUMS) point as your internal public key which has no valid corresponding private key.
How should I go about choosing such a point? Are there canonical examples to draw from?

user139306: In BIP-341, an example NUMS point is given, along with a cautionary note about leaking information:

One example of such a point is H = lift_x(0x0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0) which is constructed by taking the hash of the standard uncompressed encoding of the secp256k1 base point G as X coordinate.
In order to avoid leaking the information that key path spending is not possible it is recommended to pick a fresh integer r in the range 0...n-1 uniformly at random and use H + rG as internal key. It is possible to prove that this internal key does not have a known discrete logarithm with respect to G by revealing r to a verifier who can then reconstruct how the internal key was created.

For what it's worth, the point as-written is encoded in DER format, so in order to get the corresponding integer you have to remove the first byte (0x02).

139306: <p>Per <a href="https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki" rel="nofollow noreferrer">BIP-341</a>, if you want to create a Taproot output that is only spendable via the script-path spend (and not a key-path spend), you must &quot;pick as internal key a point with unknown discrete logarithm.&quot;</p>
<p>This requires using a nothing-up-my-sleeve (NUMS) point as your internal public key which has no valid corresponding private key.</p>
<p>How should I go about choosing such a point? Are there canonical examples to draw from?</p>
 139306: <p>In <a href="https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#user-content-Script_validation_rules" rel="nofollow noreferrer">BIP-341</a>, an example NUMS point is given, along with a cautionary note about leaking information:</p>
<blockquote>
<p>One example of such a point is H = lift_x(0x0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0) which is constructed by taking the hash of the standard uncompressed encoding of the secp256k1 base point G as X coordinate.</p>
<p>In order to avoid leaking the information that key path spending is not possible it is recommended to pick a fresh integer r in the range 0...n-1 uniformly at random and use H + rG as internal key. It is possible to prove that this internal key does not have a known discrete logarithm with respect to G by revealing r to a verifier who can then reconstruct how the internal key was created.</p>
</blockquote>
<p>For what it's worth, the point as-written is <a href="https://bitcoin.stackexchange.com/questions/92680/what-are-the-der-signature-and-sec-format">encoded in DER format</a>, so in order to get the corresponding integer you have to remove the first byte (<code>0x02</code>).</p>
