The only difference regarding the vanilla reference is the computation of
the response. This implementation adds the random component with the
challenge times private key while the Wikipedia article substracts them.
The resulting signature is compatible with EdDSA verification algorithm
when using the edwards25519 group, and by extension the CoSi verification algorithm.
Sign creates a Sign signature from a msg and a private key. This
signature can be verified with VerifySchnorr. It's also a valid EdDSA
signature when using the edwards25519 Group.