I was taking a closer look at the EdDSA to see if I could get a practical exploit going, and it looks like it might be safe, for now. Per https://minerva.crocs

I was taking a closer look at the EdDSA to see if I could get a practical exploit going, and it looks like it might be safe, for now. Per https://minerva.crocs.fi.muni.cz/ https://minerva.crocs.fi.muni.cz/, > The EdDSA scalar multiplication code in libgcrypt was leaking, however due to the way it was used, it was likely not exploitable. It did not reduce the scalar which was a SHA512 digest by the curve order, but used the digest directly, thus the leakage did not represent the bit-length of the reduced scalar. (Extended discussion: https://blog.cr.yp.to/20191024-eddsa.html https://blog.cr.yp.to/20191024-eddsa.html) Reticulum's implementation is similar in that it doesn't reduce the scalar.