computeExchangeHash

Computes the exchange hash for curve25519-sha256.

The shared secret enters the transcript mpint-encoded over its raw bytes unchanged, exactly as deployed implementations do (OpenSSH and every stack interoperating with it): leading zero bytes stripped, a sign pad added when the first raw byte has its high bit set, and no byte-order reinterpretation. RFC 8731 section 3.1 describes a big-endian reinterpretation that the deployed universe does not implement.