*
* This is X448, as described in RFC7748, based on the elliptic curve defined
* in Mike Hamburg, `Ed448-Goldilocks, a new elliptic curve', EUROCRYPT 2016,
- * https://eprint.iacr.org/2015/625/.
+ * https://eprint.iacr.org/2015/625/. (The curve here is 4-isogenous to
+ * Hamburg's curve.)
*
* The RFC-specified operation is simpler than the Diffie--Hellman function
* described in Hamburg's paper, since it doesn't involve the `Decaf'