Some background reading for deeply interested parties: https://www.sitepoint.com/what-would-you-pay-to-make-27-of-the-web-more-secure/ https://www.sitepoint.co

Some background reading for deeply interested parties: https://www.sitepoint.com/what-would-you-pay-to-make-27-of-the-web-more-secure/ https://www.sitepoint.com/what-would-you-pay-to-make-27-of-t... https://paragonie.com/blog/2017/01/let-s-make-2017-year-simply-secure-php-cryptography https://paragonie.com/blog/2017/01/let-s-make-2017-year-simp... The short answer is "compatibility, and so we can get Ed25519-signed updates into e.g. WordPress". Important to note: If you have the libsodium PHP extension installed, then ParagonIE_Sodium_Compat::foo() will proxy to \Sodium\foo() instead of using our implementation. Installing the PHP extension gets you timing-safe guarantees AND better performance. I hope that's enough of a bargaining chip to get the extension installed everywhere (and to drive the initiative to make libsodium a core extension in PHP 7.2). https://externals.io/thread/626 https://externals.io/thread/626