enhancement request: Implement McCallum-Relyea exchange

It would be great if you could implement high-level functions to support McCallum-Relyea exchange (as used in Clevis/Tang).

I started trying to mock-up something myself using Go's stdlib, but unfortunately it looks like the go maintainers are deprecating stdlib ability to e.g. perform elliptic curve group addition which is one of the fundamental steps, so there's scope for a third-party lib such as `circl` to fill the gap.

(Lots of internet descriptions of McCallum-Relyea, [here's one of many](https://crypto.stackexchange.com/questions/98602/security-of-mccallum-relyea-exchange)).