shards to disk. `tf.train.experimental.ShardByTaskPolicy` is the default
      sharding behavior, but `tf.train.experimental.MaxShardSizePolicy` can be
      used to shard the checkpoint with a maximum shard file size. Users with
      advanced use cases can also write their own custom
      `tf.train.experimental.ShardingCallback`s.

* `tf.train.CheckpointOptions`

it defers computing the NTT of s1, // s2, and t0 and the expansion of A until signing time, which is inefficient. // For a hot second, it looked like we could have all agreed to only use seeds, // but unfortunately OpenSSL and BouncyCastle lobbied hard against that during // the WGLC of the LAMPS IETF working group. Also, ACVP tests provide and expect // semi-expanded keys, so we implement them here for testing purposes. func semiExpandedPrivKeyS(p parameters) int { k, l := p.k, p.l ηBitlen := bits.Len(uint(p.η))...