Performance review

[qmuntal]

We should benchmark the go-cose public API to see where we are in terms of memory allocation and throughput.
With these metrics we will be able to evaluate if we need to invest resources on improving the performance.

While benchmarking we should treat the algorithm as an invariant, even one that does nothing, so we only benchmark things that are under our control.

This is an umbrella issue to track the benchmarking effort.

• Sign1Message.MarshalCBOR
• Sign1Message.UnmarshalCBOR
• Sign1Message.Sign
• Sign1Message.Verify
  - [ ] SignMessage.MarshalCBOR
  - [ ] SignMessage.UnmarshalCBOR
  - [ ] SignMessage.Sign
  - [ ] SignMessage.Verify

[SteveLasker]

What are the latest thoughts about supporting or deprecating sign in lieu of sign1?

[SteveLasker]

sign has been disabled, to focus on sign1 at this point in time.

[SteveLasker]

We'll close this as the latest security review is published.

[SteveLasker]

Closing as the Trail of Bits security review has been posited.