The age design includes a double invocation of X25519: once with a domain separation tweak, once with the actual secret. While implementing this I wondered: can we multiply those two scalars first, instead of doing two point multiplications in a row? It would be much faster!

Follow up: https://buttondown.email/cryptography-dispatches/archive/cryptography-dispatches-replace-pgp-with-an-https/