This allows us to shift by 256+128 = 384 bits, which is a multiple of
the limb size of the scalar representation. This also happens to be the
most precision possible for g2 that still fits into a 256-bit value.

ninja check-secp256k1