would require keeping or re-deriving ρ and t/t1, though. pk := pkEncode(priv.pub.raw[:0], ρ, t1, p) priv.pub.tr = computePublicKeyHash(pk) computeT1Hat(priv.pub.t1[:k], t1) // NTT(t₁ ⋅ 2ᵈ) return priv } func computeMatrixA(A []nttElement, ρ []byte, p parameters) { k, l := p.k, p.l for r := range k { for s := range l { A[r*l+s] = sampleNTT(ρ, byte(s), byte(r)) } } } func computePublicKeyHash(pk []byte) [64]byte { H := sha3.NewShake256() H.Write(pk) var tr [64]byte H.Read(tr[:]) return tr } func computeT1Hat(t1Hat...