* a key that appears once in `right` might appear multiple times in `left`). We don't
         * guarantee behavior in that case, anyway, and the current behavior is likely undesirable.
         * So that's either a reason to feel free to change it or a reason to not bother thinking
         * further about this.
         */
        V rightValue = uncheckedCastNullableTToT(onlyOnRight.remove(leftKey));

         * a key that appears once in `right` might appear multiple times in `left`). We don't
         * guarantee behavior in that case, anyway, and the current behavior is likely undesirable.
         * So that's either a reason to feel free to change it or a reason to not bother thinking
         * further about this.
         */
        V rightValue = uncheckedCastNullableTToT(onlyOnRight.remove(leftKey));

an "Almost Montgomery // Multiplication" by subtracting only in the overflow case, but the // cost is very similar since the constant time subtraction tells us if // x >= m as a side effect, and taking care of the broken invariant is // highly undesirable (see https://go.dev/issue/13907). copy(x.reset(n).limbs, T[n:]) x.maybeSubtractModulus(choice(c), m) // The following specialized cases follow the exact same algorithm, but // optimized for the sizes most used in RSA. addMulVVW is implemented in...