P521 implementation is slow, buggy and vulnerable to timing attacks

- Slow: You're using affine coordinates. Those are 10-100x times slower than other coordinates.
- Buggy: There are special cases you don't handle. For example computing `P + P` or `P + (-P)`.
- You don't validate public keys you receive, this enables attacks. For example the point might not on the curve.
- Timing attacks: You don't use constant time code. There are secret dependent branches.
