Go: crypto/ed25519: differences in edge case handling between s390x KDSA implementation and Go implementation

[mundaym]

@hdevalence has indentified several examples of crafted signed messages that pass verification when using the software implementation of crypto/ed25519 but fail verification when using the s390x KDSA implementation. Regardless of which is correct, the s390x KDSA implementation is new to Go 1.15 so I propose we remove it before the final release is cut to avoid the situation where we see different behaviour when running on different platforms. Once we have more information we can consider whether we can re-add it, perhaps with other fixes or custom special case handling, in a future release.

[gopherbot]

Change https://golang.org/cl/245497 mentions this issue: crypto/ed25519: remove s390x KDSA implementation

[FiloSottile]

/cc @golang/osp-team, this will need cherry-picking, how are you tracking cherry-picks?

[andybons]

@FiloSottile as the tree is still frozen, if the change lands in the master branch it will be merged into the 1.15 release branch before the next RC or final release.