in-memory format, because it defers computing the NTT of s1, // s2, and t0 and the expansion of A until signing time, which is inefficient. // For a hot second, it looked like we could have all agreed to only use seeds, // but unfortunately OpenSSL and BouncyCastle lobbied hard against that during // the WGLC of the LAMPS IETF working group. Also, ACVP tests provide and expect // semi-expanded keys, so we implement them here for testing purposes. func semiExpandedPrivKeyS(p parameters) int { k, l := p.k,...