Break malleability by producing S <= order/2