XEdDSASigning does not work with firmware-generated signatures

[lkosson]

Signature implementation in XEdDSASigning seems broken in multiple ways:

1. edPublicKey returned by GenerateEdDSAKeysFromX25519 does not match the Ed25519 public key returned by ConvertX25519PublicKeyToEd25519 computed from X25519 public key.
2. (related to 1) GenerateEdDSAKeysFromX25519 returns different keys than firmware. XEdDSA::priv_curve_to_ed_keys in firmware seems to use X25519 private key as-is, without hashing it using SHA512 nor using domain separation tag.
3. Sign and Verify methods hash incoming message using SHA512 or SHA256, while XEdDSA::sign in firmware passes message in plaintext. This might not be evident from first look, but when inspecting ImplVerify method inside BouncyCastle's Ed25519.cs (around 1010-1013 lines) one can see, that R (signature), A (public point) and m (message) are fed via BlockUpdate to SHA512 and m is already hashed by XEdDSASigning, while Ed25519.cpp (lines 204-207) in firmware feed signature, publicKey and message via update, where message is actual plaintext message.
4. GenerateEdDSAKeysFromX25519 starts with lines culminating in computing keyPair which isn't then used at all.