ml-dsa v0.1.0

[tarcieri]

Added

• Implement MultipartSigner/Verifier (#982)
• Implement the signature::Keypair trait for SigningKey (#1008)
• Support for external mu (#1023, #1074)
• Seed support i.e. SigningKey::{from_seed, to_seed} (#1054, #1094, #1341)
• Implement Hash on Signature and VerifyingKey types (#1309)
• Heap offload support for large values when alloc is enabled (#1320, #1344, #1345)
• Implement KeyInit, KeyExport, KeySizeUser, and Generate for SigningKey (#1342)

Changed

• Bump signature dependency to v3 (#954, #1321)
• Update PKCS#8 support (#1093)
• Rename and deprecate ExpandedSigningKey (#1145)
• Use the module-lattice crate (#1189)
• Use ctutils for constant-time selection; avoid branches (#1245)
• Make PartialEq impl for ExpandedSigningKey constant time (#1286)
• Bump pkcs8 dependency to v0.11 (#1316)
• Migrate from sha3 to shake (#1355)

Fixed

• no_std support (#989)
• Use Barrett reduction instead of integer division to prevent side-channels (#1144)
• Wycheproof verification test failures (#1187)
• Fix use_hint when 𝓇₀ = 0 (#1194)
• Lower stack usage (#1259, #1261)

Removed

• KeyGen trait has been removed and replaced by KeyInit and Generate (#1349)