engineVerify() comparison can be variable time, because there are no secrets
Cleanups (thx zzz)
Missed comment change
Sped up GroupElement.equals()

This probably isn't constant time because of the Z1==Z2 check. If it should be,
we can drop that first part (and there is still a speed increase from removing
the two FieldElement.invert() calls).
Refactored BigInteger-dependent code into a subpackage

Sign/verify tests fail, but all other tests pass. The problem is probably in
ScalarOps somewhere.
Test for BigIntegerScalarOps.reduce()
Fixed BigIntegerScalarOps usage of BigIntegerLittleEndianEncoding
Copied over ref10 sc_reduce replacing crypto_int64 and crypto_uint64 with long

The test fails (likely because all longs are signed in Java)
Handle unsigned part of sc_reduce correctly using BigInteger

The only BigInteger operations used are and(), or() and shift[Left|Right]()
(but it is possible that these are not constant time?)
Tests for ScalarOps.multiplyAndAdd()
Renamed BigInteger constant for clarity
Copied over ref10 sc_muladd
Pulled out constant
Use Ed25519ScalarOps instead of BigIntegerScalarOps

Before:
0.534 each sign, 2.3272 each verify, 2.8612 s+v
After:
0.5888 each sign, 2.3566 each verify, 2.9454 s+v

Sign uses reduce() twice, verify uses it once. Therefore the ref10 version is
about 28us slower than the BigInteger version. Basically negligible, so the
important factor to determine is whether the BigInteger operations used are
constant time. If we can't get the ref10 version to be constant time, we may as
well use the BigInteger version.
Common code for other FieldElement implementations
Moved I to Curve, pass it in as a parameter

Most FieldElement implementations (in particular, the ref10 implementation)
don't have a generic pow() method, and instead will have I hard-coded.
Radix 2^51 implementation of FieldElement from ref10

Before black magic:
0.5548 each sign, 2.4118 each verify, 2.9666 s+v
After black magic:
0.1572 each sign, 0.2798 each verify, 0.437 s+v
Updated README.md
Fixes to get tests passing
Use tweaked longs for unsigned instead of BigIntegers (thanks zzz)