[tarcieri]

Added

• c_tilde getter on Signature (#1362)

Changed

• Place heavy bits of the signature on the heap when available (#1419)
• Return an error when signing exhausts rejection sampling (#1481)
• Bump module-lattice to v0.2.4 (#1494)

Fixed

• Construct and clone expanded matrices one row at a time (#1444)
• Reuse public key during key generation (#1461)
• Zeroize the SHAKE state when the zeroize feature is enabled, by wiring shake/zeroize into it (#1473)
• Return an error instead of panicking from the fallible signing APIs when rejection
  sampling exhausts its attempts (#1481)
• Reject AlgorithmIdentifier parameters in PKCS#8 and SPKI keys (#1482)
• Reject oversized contexts in compute_mu (#1489)

Security

• Fixed constant time issues (#1386)
• Bump crypto-bigint to v0.7.7; MSRV 1.87 (#1475)