Implement XEdDSA aka hedged ed25519

[paulmillr]

https://www.ietf.org/archive/id/draft-irtf-cfrg-det-sigs-with-noise-03.html

http://signal.org/docs/specifications/xeddsa/

[paulmillr]

@larabr do you need it for pgp or proton?

[larabr]

Not really, because OpenPGP signatures are already randomized through a salt; we do use the hedged ed25519 version from Safari WebCrypto, but that's because we don't have the option to use the other one. I don't think we'd switch to using the hedged version from noble if you provide it, since Chromium browsers do not implement it anyway either.