This saves 4 point doublings by unwrapping the first loop iteration,
as well as 63 field multiplications (one per iteration) by managing
curve model choice explicitly.
* ADD new "batch" feature for feature-gating ed25519 batch verification; off by
default. The "batch" feature is the only thing which depends on all of the
`rand` crate, since it requires the functionality of `rand::thread_rng()`.
Without batch verification, the rest of ed25519-dalek only depends on
`rand_os` and `rand_core`.
See discussion at https://github.com/dalek-cryptography/curve25519-dalek/issues/232 , copied below:
`1.1` changed the trait bounds for `RistrettoPoint::random` and `Scalar::random`, see #222 and #219.
These changes have two benefits:
* they unlink us from the `rand` crate and make us depend only on `rand_core`;
* they allow passing both owned and borrowed RNGs.
The change was not supposed to be a breaking change, since the new bounds are strictly more general than the old ones (as every `RngCore` is an `Rng` and every `&mut RngCore` is an `RngCore`), so the new bound is satisfied in every situation where the old bound applied.
The `1.1.0-pre.0` version didn't cause problems on the crates I tested it on, but there was an unexpected problem: ce71c93a9a/spacesuit/src/value.rs (L160-L161) broke, since it took a borrow as input and used it twice. So there was slight breakage.
One option is to revert the changes (probably just the ones from #219) and release 1.1.3; another would be to fix up `slingshot` and leave the new bound.
Building the docs currently doesn't work, because rustdoc enables parts of the
code (to document them) which then don't check (because there are missing
exports or dependencies). This **should** fix the issue, but there's no way to
test without publishing a new version.
