Compatibility with signature-key-blinding

[sander]

Since draft-irtf-cfrg-signature-key-blinding is mature, we may want to reuse some of its definitions and security properties for BL. Adaptations needed:

• Introduce DeriveBlindingFactor(bk, ctx) to expose intermediate value bf and BlindSign(skS, bf, msg) to use it: no security impact expected.
• Introduce BlindDH(skX, bf, pkY) for a similar “Key Blinding for Diffie-Hellman” scheme: security proof needed (Security Proof Multiplicative Key Blinding #77).
• Allow any 32-byte string as private blind key bk for P-256, not just scalars modulo Order(), enabling direct use of KEM or hash output: security argument needed. Generalise by keeping DeriveBlindKey(ikm) which is the identity function in this case.

Further changes needed to HDK:

• Derive the private blinding key from salt.
• Derive the KEM private key from salt.

Suggested HDK interface update:

• Replace single HDK function by CreateContext(index), creating context string ctx, and Descend(salt, ctx), deriving child HDK salt'. This enables simple application of BL by both parties.
• Replace generic Authenticate(sk, reader_data, bf) with specific BlindSign and BlindDH invocations.