I'm reading Bernstein's RSA signatures and Rabin–Williams signatures: the state of the art. In section 6, Bernstein states:

Recall that Rabin’s system needed to try several values of r, on average about 4 values, before finding a square H(r,m) modulo pq. The Rabin–Williams system eliminates this problem by using tweaked square roots in place of square roots. A tweaked square root of h modulo pq is a vector (e, f, s) such that e ∈ {−1, 1}, f ∈ {1,2}, and efs2 −h ∈ pqZ; the signer’s secret primes p and q are chosen from 3 + 8Z and 7 + 8Z respectively. Each h has exactly four tweaked square roots, so each choice of r works, speeding up signatures.

If I control key generation, then I can ensure p and q are chosen from 3 + 8Z and 7 + 8Z respectively, and I can possibly use the tweaked roots. Do tweaked roots violate P1363? What I might be really asking is, does an exponent of 2 run afoul of P1363, but I'm not sure at the moment.

If I cannot use tweaked square roots and/or an exponent of 2, then what are the remaining options? Is it principal roots and Jacobi?

If I load a private key generated by another library and it does not satisfy the conditions on p and q, then what are the remaining options? Is it principal roots and Jacobi?

My apologies for asking. I don't have a copy of the P1363 standard, so I'm not sure what the potential pain points are in using the algorithm described by Bernstein.

The ultimate goal of the exercise is to remediate CVE-2015-2141 (Evgeny Sidorov paper here). I'm trying to observe P1363 but avoid Jacobi.