t may compromise
  <i class="Em" title="Em">all past messages</i>. This can be avoided by using
  protocols that provide forward secrecy, such as the X3DH key agreement
  protocol.
<h1 class="Sh" title="Sh" id="IMPLEMENTATION_DETAILS"><a class="selflink" href="#IMPLEMENTATION_DETAILS">IMPLEMENTATION
  DETAILS</a></h1>
The most significant bit of the public key is systematically ignored. It is not
  needed because every public key should be smaller than 2^255-19, which fits in
  255 bits. If another implemen