bd8b94bd0e
No security implications, but the current hash-to-curve standard defines the sign of the Y coordinate to be negative if `gx1` is a square, positive otherwise. We were doing it the other way round.
bd8b94bd0e