p521 { panic("ecdsa: internal error: unexpectedly masking off bits") } b = rightShift(b, excess) } // FIPS 186-5, Appendix A.4.2 makes us check x <= N - 2 and then return // x + 1. Note that it follows that 0 < x + 1 < N. Instead, SetBytes // checks that k < N, and we explicitly check 0 != k. Since k can't be // negative, this is strictly equivalent. None of this matters anyway // because the chance of selecting zero is cryptographically negligible. if k, err := bigmod.NewNat().SetBytes(b, c.N); err...