Break malleability by producing S <= order/2
Merge remote-tracking branch 'upstream/master'