Improve fingerprint routine, but maybe not enough

We must show that the extra25519.edwardsToMontgomeryX operation from
agl/ed25519/extra25519/extra25519.go cannot be reverse though to use this.
If extra25519.edwardsToMontgomeryX were reversable then an attacker with
access to the server could derive a users fingerprint from their public
identity key to discover limited traffic information about the user.