1.0.16

• Signatures computations and verifications are now way faster on 64-bit platforms with compilers supporting 128-bit arithmetic (gcc, clang, icc). This includes the WebAssembly target.
• New low-level APIs for computations over edwards25519: crypto_scalarmult_ed25519(), crypto_scalarmult_ed25519_base(), crypto_core_ed25519_is_valid_point(), crypto_core_ed25519_add(),
  crypto_core_ed25519_sub() and crypto_core_ed25519_from_uniform() (elligator representative to point).
• crypto_sign_open(), crypto_sign_verify_detached() and crypto_sign_edwards25519sha512batch_open` now reject public keys in non-canonical form in addition to low-order points.
• The library can be built with ED25519_NONDETERMINISTIC defined in order to use synthetic nonces for EdDSA. This is disabled by default.
• Webassembly: crypto_pwhash_*() functions are now included in non-sumo builds.
• sodium_stackzero() was added to wipe content off the stack.
• Android: support new SDKs where unified headers have become the default.
• The Salsa20-based PRNG example is now thread-safe on platforms with support for thread-local storage, optionally mixes bits from RDRAND.
• CMAKE: static library detection on Unix systems has been improved (thanks to @BurningEnlightenment, @nibua-r, @mellery451)
• Argon2 and scrypt are slightly faster on Linux.