It can be used to reduce modulo m a value up to 2m - 1, which is a common // range for results computed by higher level operations. // // always is usually a carry that indicates that the operation that produced x // overflowed its size, meaning abstractly x > 2^_W*n > m even if x < m. // // x and m operands must have the same announced length. // //go:norace func (x *Nat) maybeSubtractModulus(always choice, m *Modulus) { t := NewNat().set(x) underflow := t.sub(m.nat) // We keep the result if x -...