Nothing is wrong with the current implementation. But it looks out of
place because we generally prefer bit operations because they're faster
and are more likely constant-time.

ninja check-secp256k1