What's the threat model? I've looked into the code. It uses Nettle's Curve25519 which seems to be implemented constant-time (assuming ECC mul is using "ecc-mul

What's the threat model? I've looked into the code. It uses Nettle's Curve25519 which seems to be implemented constant-time (assuming ECC mul is using "ecc-mul-g" from which is protected against cache timing attacks because the other ecc-mul implementations are using raw table access.)