Are sipa's standardized schnorr signatures incompatible with blind signatures?
Andrew Poelstra suggests that:

R' = R + alpha*G + beta*G


should be put in a loop .. whenever R.x is not a quadratic residue. You can change beta and this should give you compat with sipa's scheme with no security, privacy loss or blind-sig-linkability loss