Allow creating hedged EdDSA signatures?

[twiss]

The current specification of EdDSA, in RFC 8032 (which we refer to), defines Ed25519 and Ed448 as being deterministic.

WebKit's implementation of Ed25519, when using macOS's CryptoKit, produces hedged (non-deterministic) signatures as per draft-irtf-cfrg-det-sigs-with-noise, citing security benefits.

So, we may want to allow this as well in the spec.

---

This is a copy of WICG/webcrypto-secure-curves#28, to keep track of that issue after we archive WICG/webcrypto-secure-curves.

[ChALkeR]

also cc @panva and @paulmillr here

@twiss whatever language is used to allow that in the spec, it should not encourage (or even allow?) RNG -> k, it should require hedged nonces per that draft.

And Chromium will need their Boring to implement hedged for this I think

Also #163 is related (which likely should also switch to hedged, not deteministic)