Merge branches 'mdw/latin-ietf' and 'mdw/curve25519'

Merge branches 'mdw/latin-ietf' and 'mdw/curve25519'

* mdw/latin-ietf:
  symm/{chacha,salsa20}.[ch]: Support RFC7539-style 96-bit nonces.
  symm/{chacha,salsa20}.c: Change how the test code sets up the cipher.
  symm/{chacha,salsa20}.c: Abstract out cipher and rand initialization.
  symm/{chacha,salsa20}.[ch]: Compress systematic naming better in comments.
  symm/stub.h.in: Fix bogus characters in the include guard macro name.
  symm/stub.h.in: Add include guard around header.
  symm/t/chacha: Fix typo in comment.

* mdw/curve25519:
  pub/, progs/: Add support for X448 key exchange, defined in RFC7748.
  math/fgoldi.c: Add support for Hamburg's `Goldilocks' field.
  pub/, progs/: Implement Bernstein's Ed25519 signature scheme.
  math/f25519.[ch]: More field operations.
  pub/, progs/: Implement Bernstein's X25519 key-exchange algorithm.
  math/f25519.c: Implementation for arithmetic in GF(2^255 - 19).
  .gitignore, utils/.gitignore: Change Sage ignore rules.