one algorithm, its own package, an audited provenance
Before an algorithm can be trusted it has to be inspectable in isolation. Ours arrived tangled into a larger system: key generation, signing and the arithmetic underneath all moved together, and a defect anywhere looked like a defect…