TODO: canonic Ed25519

[AljoschaMeyer]

The RFC defining ed25519 leaves some ambiguity around signature verification. Our implementation currently uses ed25519_dalek::VerifyingKey::verify_strict. NEed to update the spec to reflect this. Can also use this opportunity to consider ristretto25519 once again.

CC dalek-cryptography/curve25519-dalek#852