This was presumably added for use with formulas that use two multiplications by
small constants (i.e., 121665 and 121666) instead of one multiplication by a
large constant (i.e., -121665/121666), but we don't use those formulas.
The Scalar type is stored in memory as an array of bytes. This allows easy
access to the bits of a scalar for Scalar x Point operations, at the cost of
forcing a pack/unpack for Scalar x Scalar. This commit splits the Scalar type
into Scalar (packed) and UnpackedScalar (limbs).
This adds a dependency on the `rand` crate, used to construct an
OS-backed CSPRNG. The implementation in this commit is somewhat
inefficient as it constructs a new OsRng object every time; it might be
better to construct it once. (Seems like a lot of overhead for a few
getrandom(2) calls...)
This should be brought back later as part of reworking the compressed
point formats / serialization code. Right now there's just
"CompressedPoint" which is in the ed25519 format. Ideally, users should
be able to serialize points to formats used for X25519, for decaf, etc.
and not have to worry too much about the internal model.
