subtraction tells us if // x >= m as a side effect, and taking care of the broken invariant is // highly undesirable (see https://go.dev/issue/13907). copy(x.reset(n).limbs, T[n:]) x.maybeSubtractModulus(choice(c), m) // The following specialized cases follow the exact same algorithm, but // optimized for the sizes most used in RSA. addMulVVW is implemented in // assembly with loop unrolling depending on the architecture and bounds // checks are removed by the compiler thanks to the constant size. case...