@zhenech
Well, ED25519 isn't NIST, so that would make sense (no point in having a security standard if you're going to allow using algorithms that aren't part of said standard).

I suspect using ECDSA with one of the NIST curves works? P-384 is pretty good too, and not suspect like Dual_EC_DRBG always was, even before Snowden confirmed it was compromised.
@cloonix

@zhenech
Oh jeez, yeah that sucks, annoying combination of design choices that don't work together very well 🙄
@cloonix