anchor.diff:      (produce-digest digest)))
   
   (defun ed25519-public-key (sk)
  +  "Compute the public key associated to the private key SK."
     (let ((h (ed25519-hash sk)))
       (setf h (subseq h 0 (/ +ed25519-bits+ 8)))
       (setf (ldb (byte 3 0) (elt h 0)) 0)
  
positive.code:     (ed25519-verify signature (subseq message start end) pk)))
  
  (defmethod generate-key-pair ((kind (eql :ed25519)) &key &allow-other-keys)
    (let* ((prng (or *prng* (ironclad:make-prng :fortuna :seed :random)))
           (sk (ironclad:random-data (/ +ed25519-bits+ 8) prng)))
      (setf (ldb (byte 3 0) (elt sk 0)) 0)
      (setf (ldb (byte 2 6) (elt sk (- (/ +ed25519-bits+ 8) 1))) 1)
      (let ((pk (ed25519-public-key sk)))
  
negative.code:   (modular-inverse (mod x +ed25519-q+) +ed25519-q+))
  
  (defun ed25519-recover-x (y)
    "Recover the X coordinate of a point on curve25519 from the Y coordinate."
    (declare (optimize (speed 3) (safety 0) (space 0) (debug 0)))
    (let* ((yy (mod (* y y) +ed25519-q+))
           (xx (mod (* (- yy 1) (ed25519-inv (+ (* +ed25519-d+ yy) 1))) +ed25519-q+))
  