pub fn digits_from_xof(xof: &[u8; 64]) -> [u8; 68]Expand description
Extract low two bits from each XOF byte and append the complement checksum.
Input: 64 XOF bytes. Output: 68 digits in 0..=3. Digits 0..64 are the low
two bits of each byte. The checksum is Σ (3 − digit) (at most 64 × 3 =
192, which fits in four base-4 digits) and is written little endian into
digits 64..68. The hardware signer (crate::slice_signer) does the same
split.