More efficient and just as secure to sign message hash using Ed25519? According to the Ed25519 paper, the (potentially long) input message is hashed twice (see Section 4 page 12 steps 1 and 3).  This webpage has a nice diagram toward the bottom that illustrates this, and I confirmed it in the reference code on Supercop (see supercop-20141124/crypto_sign/ed25519/ref/sign.c, function calls  crypto_hash_sha512(nonce, sm+32, mlen+32) and crypto_hash_sha512(hram,sm,mlen + 64)).

My question is, for long messages, wouldn't it be more efficient and just as secure to hash the entire message just once, and then use the 64 byte hash as the input to the signing algorithm?  In other words, the code would look like:

crypto_hash_sha512(mhash, m, mlen);
crypto_sign(output, mhash, 64, key);


The would seem to me to be faster for mlen > approx 128 bytes without any loss of security.

I'm I missing something here?  Is there a potential loss of security to using mhash as the signing input instead of the original message m?
Peter Schwabe, one of the authors of Ed25519, directed me to a recent paper titled "EdDSA for more curves".  The section "Security notes on prehashing", page 5, says that the Ed25519 algorithm without prehashing the message is resistant to collisions in the hash function, while using the algorithm with prehashing is not.  Of course the hash function is not supposed to have collisions, but if it does, not prehashing gives added protection.