ed25519_open(): check that S < l
Not strictly required, but I don't see any downsides either.
and -> and/or