ed25519 + system randomness

[burdges]

There are several reasons one might desire an ed25519 flavor that employs system randomness, in addition to the usual derandomization. I've no idea any relevant standards exist, but the obvious method would be hashing 32 bytes of system randomness first when computing r. I could easily be done externally of course, but figured I'd ask here.

[tarcieri]

Here's a draft: https://www.ietf.org/archive/id/draft-irtf-cfrg-det-sigs-with-noise-03.html#name-hedged-eddsa

[burdges]

The primary reasons to do this is actually multi-signatures schemes, like OLAF, FROST, etc, which doesn't matter if you're not doing those.

At the moment I almost wanted it just to save a few bytes a few when doing a back cert that should be "ephemeral", but that's kinda stupid of me.

[tarcieri]

Preventing fault attacks on deterministic signature algorithms is another reason, particularly on embedded platforms