gf_lobit
enc[EDDSA_448_PRIVATE_BYTES - 1] |= 0x80 & gf_lobit(t);
gf_cond_neg(p->x, gf_lobit(p->x) ^ low);
mask_t gf_lobit(const gf x);