but see the comment on // rightShift. // // These are the most dangerous lines in the package and maybe in the // library: a single bit of bias in the selection of nonces would likely // lead to key recovery, but no tests would fail. Look but DO NOT TOUCH. if excess := len(b)*8 - c.N.BitLen(); excess > 0 { // Just to be safe, assert that this only happens for the one curve that // doesn't have a round number of bits. if c.curve != p521 { panic("ecdsa: internal error: unexpectedly masking off bits")...