I unfortunately implemented and maintained several cryptographic algorithms (block ciphers, UMACs, key exchanges, whatnot, a bunch of it proprietary for extra a

I unfortunately implemented and maintained several cryptographic algorithms (block ciphers, UMACs, key exchanges, whatnot, a bunch of it proprietary for extra awfulness) and compression algorithms in JavaScript as part of a previous job. It was awful, and I broke the JIT more times than I could count. JS is not well-suited for this. I still find the argument to be wrong, in the sense that picking Ed25519 is an entirely correct decision to make. Picking that library is not a correct decision, and that might lead to needing a different algo (I'd argue that WebCrypto needs to pick up its pace for common algorithms, rather than picking picking up whatever dropped fruit is available). We shouldn't slander them for Ed25519 (although you are right that such claim about timing safety is borked—maybe that got lost in marketing). We should only target the library choice. Plus, with WASM widely available, we should be able to port a constant-time of Ed25519 with good performance without much work. WebCrypto is just a cherry on top.