Would it be reasonable to do multiscalar multiplication? Or are downstream crates doing that with bititerators directly somehow? There is relevant discussion around curve25519 for - traits: https://github.com/hdevalence/curve25519-dalek/commit/7ce6f9058900cd4045c9fce8fa4bc8ca7b797a8c https://github.com/dalek-cryptography/curve25519-dalek/issues/125 - algorithm choice: https://github.com/dalek-cryptography/curve25519-dalek/pull/129