s1, // s2, and t0 and the expansion of A until signing time, which is inefficient. // For a hot second, it looked like we could have all agreed to only use seeds, // but unfortunately OpenSSL and BouncyCastle lobbied hard against that during // the WGLC of the LAMPS IETF working group. Also, ACVP tests provide and expect // semi-expanded keys, so we implement them here for testing purposes. func semiExpandedPrivKeyS(p parameters) int { k, l := p.k, p.l ηBitlen := bits.Len(uint(p.η)) + 1 // ρ + K +...