Neat! I only saw it done with 2-3 variable predictable leading bits before. A Schnorr-style signature with a deterministic nonce, like djb's EdDSA/Ed25519, is

Neat! I only saw it done with 2-3 variable predictable leading bits before. A Schnorr-style signature with a deterministic nonce, like djb's EdDSA/Ed25519, is probably a better way to go these days, since the patents expired...!