CURVE25519_NWAY: unbalance the execution tree to ...

guarantee that the KDC only performs the maths twice.