Squashed commit of the following:v0.1.2

commit 1c26ef86a04690120f4f752c7c5018a570ec5880
Author: vnugent <public@vaughnnugent.com>
Date:   Wed May 29 13:34:20 2024 -0400

    missed extra argument

commit 88c9095743a12cf8fc1793c607ba3a1e4fa86483
Author: vnugent <public@vaughnnugent.com>
Date:   Wed May 29 13:25:51 2024 -0400

    refactor!: return NC_SUCCESS when validating secret key

commit 718be80a4810b9352de7eb0707da54020aa6b649
Author: vnugent <public@vaughnnugent.com>
Date:   Mon May 27 14:52:41 2024 -0400

    fix: Properly build mbedtls & cmake fixes

commit a8a6efb2319f739e5faae550561dc27d9dd1e88d
Author: vnugent <public@vaughnnugent.com>
Date:   Sun May 26 17:39:40 2024 -0400

    chore: Update libs, reorder files, internalize private headers

commit 72e1b7be4031e2fd4d258fcf434ad049c0029201
Author: vnugent <public@vaughnnugent.com>
Date:   Sun May 26 13:39:08 2024 -0400

    fix: Add c++ extern prototypes in noscrypt.h

commit aeaac8d328b75911541be64d6f09d58fca294a08
Author: vnugent <public@vaughnnugent.com>
Date:   Sun May 26 11:47:17 2024 -0400

    refactor: Dep update, openssl chacha20 added

commit 86b02540cce6015cfe4a2a56499a9a2f45d4e368
Author: vnugent <public@vaughnnugent.com>
Date:   Sat May 18 12:24:17 2024 -0400

    refactor: Remove NCContext structure definition

commit d09d9330415d463ca19be9394b02ce11b3366f7e
Author: vnugent <public@vaughnnugent.com>
Date:   Mon May 13 22:33:50 2024 -0400

    fix: update mbedtls inline issue includes

commit 7838cb4bb15d4f453f92f56ece75e2b03986fe42
Author: vnugent <public@vaughnnugent.com>
Date:   Mon May 13 22:29:16 2024 -0400

    fix: force fPIC for secp256k1 targets

commit d76f7708bc6ae81a638ca708230ac9153ac754e2
Merge: aa8033d a526139
Author: vnugent <public@vaughnnugent.com>
Date:   Sun May 12 00:37:01 2024 -0400

    Merge branch 'master' into develop

commit aa8033d4dbfebeb72b6fd7a0cd218ebde0eb54dd
Author: vnugent <public@vaughnnugent.com>
Date:   Sun May 12 00:34:20 2024 -0400

    Final overview and test before tag

commit 4e3ead2cf1d3068e77f0959dfdc17e20e9102a0f
Merge: 2cee801 872c49d
Author: vnugent <public@vaughnnugent.com>
Date:   Mon May 6 22:08:09 2024 -0400

    Merge branch 'master' into develop

commit 2cee801979bfbcb3b0e53f592ce8c779b57cb679
Author: vnugent <public@vaughnnugent.com>
Date:   Mon May 6 22:02:39 2024 -0400

    Ensure static and dynamic libs get same args

commit f533694023133552d0d42933d779c95a5854343f
Author: vnugent <public@vaughnnugent.com>
Date:   Mon May 6 21:50:29 2024 -0400

    feat: CMake install & fetch-content test & updates

commit 940ff20348b13d0bc30d9e9f4289dd6de20b16ba
Author: vnugent <public@vaughnnugent.com>
Date:   Sun May 5 14:07:28 2024 -0400

    codeberg readonly push

commit b34ed055c0b7d143561ce8798e0a95313b9224bd
Merge: 0a40e20 e737556
Author: vnugent <public@vaughnnugent.com>
Date:   Sat May 4 14:06:45 2024 -0400

    Merge branch 'master' into develop

commit 0a40e209d03e8ff9b6f81cd5969d3e845c633bfc
Author: vnugent <public@vaughnnugent.com>
Date:   Sat May 4 13:55:19 2024 -0400

    ci: Force disable testing for win ci builds

commit 55fae189fffc86f07a3448370f0a746670819712
Author: vnugent <public@vaughnnugent.com>
Date:   Thu May 2 21:54:35 2024 -0400

    feat: Working and tested openssl impl & defaults

commit 6ff8bb11774c51fd341b7699a3938fd894995fbf
Author: vnugent <public@vaughnnugent.com>
Date:   Thu Apr 25 17:45:42 2024 -0400

    refactor: Finish support and testing for mbedtls

commit 7cb7a93de4f6f5e741bc5129e3d928e44f050930
Author: vnugent <public@vaughnnugent.com>
Date:   Tue Apr 23 18:19:31 2024 -0400

    refactor!: MbedTLS on Windows, switch to uint32

commit 30e8dda6cbea86bdee6d5dfe48514385d3b9f81b
Author: vnugent <public@vaughnnugent.com>
Date:   Tue Apr 23 14:48:05 2024 -0400

    refactor: Crypto dep redesign working on Windows

commit d09c6c1bd5da3e2d79351daeba304ca99976a726
Author: vnugent <public@vaughnnugent.com>
Date:   Thu Apr 18 00:28:51 2024 -0400

    refactor!: Pushing what I have to dev

commit 54e06ada7d624ed0d28c6a6db04a149708841bf8
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Apr 13 01:24:00 2024 -0400

    fix: convert constants to hex, inline macro, ParseErrorCode

commit 4215e3100d9a0d23119080d09638fa5b60d0c6d4
Merge: d3328f4 7485aa5
Author: vnugent <public@vaughnnugent.com>
Date:   Wed Apr 3 18:26:30 2024 -0400

    Merge branch 'master' into develop

commit d3328f4152b22b28f24c43dda62464287f1efff5
Author: vnugent <public@vaughnnugent.com>
Date:   Wed Apr 3 18:22:56 2024 -0400

    build: Included dependency and versions in client builds

commit b11bc0bac955fd5c6db65f0da48456bf5e748805
Author: vnugent <public@vaughnnugent.com>
Date:   Wed Apr 3 18:10:08 2024 -0400

    fix: Fix c89 compatabilty comments and struct assignment

commit 9915bd41799a72413e6b400e150aa9f5fa797e25
Merge: 8e3d6ea 5184d7d
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Mar 30 09:57:30 2024 -0400

    Merge branch 'master' into develop

commit 8e3d6ea5e3c83fe42cb904b6ccc4fe2b73f76aae
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Mar 30 09:52:55 2024 -0400

    refactor!: Some api (struct) changes and updated tests

commit e88e8420520204e20802516f01d4488bb0b1d6ea
Merge: 490dfee 21f6c0a
Author: vnugent <public@vaughnnugent.com>
Date:   Sun Mar 3 15:02:34 2024 -0500

    Merge branch 'master' into develop

commit 490dfee4ef22479009627435c6ad728c3cbbab54
Author: vnugent <public@vaughnnugent.com>
Date:   Sun Mar 3 14:59:25 2024 -0500

    test: #3 tests for encryption/description and Macs

commit efa97490b7ed47f4e2f05bee52e2b33e14e439e6
Merge: 1b84e3c 120022a
Author: vnugent <public@vaughnnugent.com>
Date:   Sun Mar 3 14:55:48 2024 -0500

    merge master

commit 1b84e3c7c2e55b1ff9ffdd09b66873e11c131441
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Mar 2 22:57:36 2024 -0500

    fix: #2 constent usage of sizeof() operator on struct types

commit 9de5a214c66adea0ef2d0bac63c59449de202a88
Author: vnugent <public@vaughnnugent.com>
Date:   Fri Mar 1 14:30:36 2024 -0500

    perf: avoid nc_key struct copy, cast and verify instead

commit b917b761120ed684af28d0707673ffadcf14b8fe
Author: vnugent <public@vaughnnugent.com>
Date:   Mon Feb 12 22:06:50 2024 -0500

    fix: found the constant time memcompare function

commit 9f85fff3b9f25da7410569ea94f994b88feb3910
Author: vnugent <public@vaughnnugent.com>
Date:   Fri Feb 9 22:48:35 2024 -0500

    feat: added/update MAC functions to sign or verify nip44 payload

commit aa5113741bb419b02d6ea416bba571fa3d65db46
Author: vnugent <public@vaughnnugent.com>
Date:   Wed Feb 7 01:37:53 2024 -0500

    add missing hmac-key output buffer

commit 55f47d22cc9ce4d1e22b70814d608c7ef3b1bbc9
Author: vnugent <public@vaughnnugent.com>
Date:   Sun Feb 4 21:08:13 2024 -0500

    simple bug fixes, and public api argument validation tests

commit 73c5a713fb164ae8b4ac8a891a8020e08eae0a3b
Author: vnugent <public@vaughnnugent.com>
Date:   Fri Feb 2 23:05:48 2024 -0500

    update api to return secpvalidate return code instead of internal return codes

commit 06c73004e1a39a7ea4ea3a89c22dee0f66adb236
Author: vnugent <public@vaughnnugent.com>
Date:   Fri Feb 2 19:25:17 2024 -0500

    change to lgpl license

commit 6e79fdb3b6b6739fc7797d47e55a7691306cf736
Author: vnugent <public@vaughnnugent.com>
Date:   Wed Jan 31 21:30:49 2024 -0500

    move validation macros, and optionally disable them

commit ac1e58837f1ba687939f78b5c03cadd346c10ddd
Author: vnugent <public@vaughnnugent.com>
Date:   Tue Jan 30 12:25:05 2024 -0500

    couple more tests, renable range checks, set flags for all projects

14 files changed, 631 insertions, 400 deletions

diff --git a/vendor/mbedtls/include/mbedtls/config_adjust_legacy_from_psa.h b/vendor/mbedtls/include/mbedtls/config_adjust_legacy_from_psa.h
index 0091e24..0e4759d 100644
--- a/vendor/mbedtls/include/mbedtls/config_adjust_legacy_from_psa.h
+++ b/vendor/mbedtls/include/mbedtls/config_adjust_legacy_from_psa.h
@@ -498,7 +498,6 @@
  * The PSA implementation has its own implementation of HKDF, separate from
  * hkdf.c. No need to enable MBEDTLS_HKDF_C here.
  */
-#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1
 #define MBEDTLS_PSA_BUILTIN_ALG_HKDF 1
 #endif /* !MBEDTLS_PSA_ACCEL_ALG_HKDF */
 #endif /* PSA_WANT_ALG_HKDF */
@@ -509,7 +508,6 @@
  * The PSA implementation has its own implementation of HKDF, separate from
  * hkdf.c. No need to enable MBEDTLS_HKDF_C here.
  */
-#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1
 #define MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT 1
 #endif /* !MBEDTLS_PSA_ACCEL_ALG_HKDF_EXTRACT */
 #endif /* PSA_WANT_ALG_HKDF_EXTRACT */
@@ -520,7 +518,6 @@
  * The PSA implementation has its own implementation of HKDF, separate from
  * hkdf.c. No need to enable MBEDTLS_HKDF_C here.
  */
-#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1
 #define MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND 1
 #endif /* !MBEDTLS_PSA_ACCEL_ALG_HKDF_EXPAND */
 #endif /* PSA_WANT_ALG_HKDF_EXPAND */
@@ -630,9 +627,6 @@
 #if !defined(MBEDTLS_PSA_ACCEL_ALG_PBKDF2_HMAC)
 #define MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC 1
 #define PSA_HAVE_SOFT_PBKDF2_HMAC 1
-#if !defined(MBEDTLS_PSA_ACCEL_ALG_HMAC)
-#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1
-#endif /* !MBEDTLS_PSA_ACCEL_ALG_HMAC */
 #endif /* !MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
 #endif /* PSA_WANT_ALG_PBKDF2_HMAC */
 
diff --git a/vendor/mbedtls/include/mbedtls/config_psa.h b/vendor/mbedtls/include/mbedtls/config_psa.h
index 17da61b..de961ec 100644
--- a/vendor/mbedtls/include/mbedtls/config_psa.h
+++ b/vendor/mbedtls/include/mbedtls/config_psa.h
@@ -22,6 +22,8 @@
 
 #include "psa/crypto_adjust_config_synonyms.h"
 
+#include "psa/crypto_adjust_config_dependencies.h"
+
 #include "mbedtls/config_adjust_psa_superset_legacy.h"
 
 #if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
diff --git a/vendor/mbedtls/include/psa/crypto_adjust_config_dependencies.h b/vendor/mbedtls/include/psa/crypto_adjust_config_dependencies.h
new file mode 100644
index 0000000..5a22205
--- /dev/null
+++ b/vendor/mbedtls/include/psa/crypto_adjust_config_dependencies.h
@@ -0,0 +1,43 @@
+/**
+ * \file psa/crypto_adjust_config_dependencies.h
+ * \brief Adjust PSA configuration by resolving some dependencies.
+ *
+ * This is an internal header. Do not include it directly.
+ *
+ * See docs/proposed/psa-conditional-inclusion-c.md.
+ * If the Mbed TLS implementation of a cryptographic mechanism A depends on a
+ * cryptographic mechanism B then if the cryptographic mechanism A is enabled
+ * and not accelerated enable B. Note that if A is enabled and accelerated, it
+ * is not necessary to enable B for A support.
+ */
+/*
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ */
+
+#ifndef PSA_CRYPTO_ADJUST_CONFIG_DEPENDENCIES_H
+#define PSA_CRYPTO_ADJUST_CONFIG_DEPENDENCIES_H
+
+#if (defined(PSA_WANT_ALG_TLS12_PRF) && \
+    !defined(MBEDTLS_PSA_ACCEL_ALG_TLS12_PRF)) || \
+    (defined(PSA_WANT_ALG_TLS12_PSK_TO_MS) && \
+    !defined(MBEDTLS_PSA_ACCEL_ALG_TLS12_PSK_TO_MS)) || \
+    (defined(PSA_WANT_ALG_HKDF) && \
+    !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF)) || \
+    (defined(PSA_WANT_ALG_HKDF_EXTRACT) && \
+    !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF_EXTRACT)) || \
+    (defined(PSA_WANT_ALG_HKDF_EXPAND) && \
+    !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF_EXPAND)) || \
+    (defined(PSA_WANT_ALG_PBKDF2_HMAC) && \
+    !defined(MBEDTLS_PSA_ACCEL_ALG_PBKDF2_HMAC))
+#define PSA_WANT_ALG_HMAC 1
+#define PSA_WANT_KEY_TYPE_HMAC 1
+#endif
+
+#if (defined(PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128) && \
+    !defined(MBEDTLS_PSA_ACCEL_ALG_PBKDF2_AES_CMAC_PRF_128))
+#define PSA_WANT_KEY_TYPE_AES 1
+#define PSA_WANT_ALG_CMAC 1
+#endif
+
+#endif /* PSA_CRYPTO_ADJUST_CONFIG_DEPENDENCIES_H */
diff --git a/vendor/openssl/include/openssl/cmp.h.in b/vendor/openssl/include/openssl/cmp.h.in
index ad9eb34..c46b9ab 100644
--- a/vendor/openssl/include/openssl/cmp.h.in
+++ b/vendor/openssl/include/openssl/cmp.h.in
@@ -228,6 +228,12 @@ DECLARE_ASN1_DUP_FUNCTION(OSSL_CMP_ITAV)
 {-
     generate_stack_macros("OSSL_CMP_ITAV");
 -}
+
+typedef struct ossl_cmp_crlstatus_st OSSL_CMP_CRLSTATUS;
+{-
+    generate_stack_macros("OSSL_CMP_CRLSTATUS");
+-}
+
 typedef struct ossl_cmp_revrepcontent_st OSSL_CMP_REVREPCONTENT;
 typedef struct ossl_cmp_pkisi_st OSSL_CMP_PKISI;
 DECLARE_ASN1_FUNCTIONS(OSSL_CMP_PKISI)
@@ -257,7 +263,7 @@ void OSSL_CMP_ITAV_set0(OSSL_CMP_ITAV *itav, ASN1_OBJECT *type,
                         ASN1_TYPE *value);
 ASN1_OBJECT *OSSL_CMP_ITAV_get0_type(const OSSL_CMP_ITAV *itav);
 ASN1_TYPE *OSSL_CMP_ITAV_get0_value(const OSSL_CMP_ITAV *itav);
-int OSSL_CMP_ITAV_push0_stack_item(STACK_OF(OSSL_CMP_ITAV) **itav_sk_p,
+int OSSL_CMP_ITAV_push0_stack_item(STACK_OF(OSSL_CMP_ITAV) **sk_p,
                                    OSSL_CMP_ITAV *itav);
 void OSSL_CMP_ITAV_free(OSSL_CMP_ITAV *itav);
 
@@ -278,6 +284,22 @@ int OSSL_CMP_ITAV_get0_rootCaKeyUpdate(const OSSL_CMP_ITAV *itav,
                                        X509 **newWithOld,
                                        X509 **oldWithNew);
 
+OSSL_CMP_CRLSTATUS *OSSL_CMP_CRLSTATUS_create(const X509_CRL *crl,
+                                              const X509 *cert, int only_DN);
+OSSL_CMP_CRLSTATUS *OSSL_CMP_CRLSTATUS_new1(const DIST_POINT_NAME *dpn,
+                                            const GENERAL_NAMES *issuer,
+                                            const ASN1_TIME *thisUpdate);
+int OSSL_CMP_CRLSTATUS_get0(const OSSL_CMP_CRLSTATUS *crlstatus,
+                            DIST_POINT_NAME **dpn, GENERAL_NAMES **issuer,
+                            ASN1_TIME **thisUpdate);
+void OSSL_CMP_CRLSTATUS_free(OSSL_CMP_CRLSTATUS *crlstatus);
+OSSL_CMP_ITAV
+*OSSL_CMP_ITAV_new0_crlStatusList(STACK_OF(OSSL_CMP_CRLSTATUS) *crlStatusList);
+int OSSL_CMP_ITAV_get0_crlStatusList(const OSSL_CMP_ITAV *itav,
+                                     STACK_OF(OSSL_CMP_CRLSTATUS) **out);
+OSSL_CMP_ITAV *OSSL_CMP_ITAV_new_crls(const X509_CRL *crls);
+int OSSL_CMP_ITAV_get0_crls(const OSSL_CMP_ITAV *it, STACK_OF(X509_CRL) **out);
+
 void OSSL_CMP_MSG_free(OSSL_CMP_MSG *msg);
 
 /* from cmp_ctx.c */
@@ -521,6 +543,9 @@ int OSSL_CMP_get1_caCerts(OSSL_CMP_CTX *ctx, STACK_OF(X509) **out);
 int OSSL_CMP_get1_rootCaKeyUpdate(OSSL_CMP_CTX *ctx,
                                   const X509 *oldWithOld, X509 **newWithNew,
                                   X509 **newWithOld, X509 **oldWithNew);
+int OSSL_CMP_get1_crlUpdate(OSSL_CMP_CTX *ctx, const X509 *crlcert,
+                            const X509_CRL *last_crl,
+                            X509_CRL **crl);
 
 #  ifdef  __cplusplus
 }
diff --git a/vendor/openssl/include/openssl/cmperr.h b/vendor/openssl/include/openssl/cmperr.h
index 0d876e5..700ffbe 100644
--- a/vendor/openssl/include/openssl/cmperr.h
+++ b/vendor/openssl/include/openssl/cmperr.h
@@ -60,7 +60,9 @@
 #  define CMP_R_FAILED_EXTRACTING_PUBKEY                   141
 #  define CMP_R_FAILURE_OBTAINING_RANDOM                   110
 #  define CMP_R_FAIL_INFO_OUT_OF_RANGE                     129
+#  define CMP_R_GENERATE_CRLSTATUS                         198
 #  define CMP_R_GETTING_GENP                               192
+#  define CMP_R_GET_ITAV                                   199
 #  define CMP_R_INVALID_ARGS                               100
 #  define CMP_R_INVALID_GENP                               193
 #  define CMP_R_INVALID_OPTION                             174
@@ -100,6 +102,7 @@
 #  define CMP_R_TRANSFER_ERROR                             159
 #  define CMP_R_UNCLEAN_CTX                                191
 #  define CMP_R_UNEXPECTED_CERTPROFILE                     196
+#  define CMP_R_UNEXPECTED_CRLSTATUSLIST                   201
 #  define CMP_R_UNEXPECTED_PKIBODY                         133
 #  define CMP_R_UNEXPECTED_PKISTATUS                       185
 #  define CMP_R_UNEXPECTED_POLLREQ                         105
@@ -107,6 +110,7 @@
 #  define CMP_R_UNEXPECTED_SENDER                          106
 #  define CMP_R_UNKNOWN_ALGORITHM_ID                       134
 #  define CMP_R_UNKNOWN_CERT_TYPE                          135
+#  define CMP_R_UNKNOWN_CRL_ISSUER                         200
 #  define CMP_R_UNKNOWN_PKISTATUS                          186
 #  define CMP_R_UNSUPPORTED_ALGORITHM                      136
 #  define CMP_R_UNSUPPORTED_KEY_TYPE                       137
diff --git a/vendor/openssl/include/openssl/crypto.h.in b/vendor/openssl/include/openssl/crypto.h.in
index 5d7d3fd..034f150 100644
--- a/vendor/openssl/include/openssl/crypto.h.in
+++ b/vendor/openssl/include/openssl/crypto.h.in
@@ -536,6 +536,8 @@ int OSSL_LIB_CTX_load_config(OSSL_LIB_CTX *ctx, const char *config_file);
 void OSSL_LIB_CTX_free(OSSL_LIB_CTX *);
 OSSL_LIB_CTX *OSSL_LIB_CTX_get0_global_default(void);
 OSSL_LIB_CTX *OSSL_LIB_CTX_set0_default(OSSL_LIB_CTX *libctx);
+int OSSL_LIB_CTX_get_conf_diagnostics(OSSL_LIB_CTX *ctx);
+void OSSL_LIB_CTX_set_conf_diagnostics(OSSL_LIB_CTX *ctx, int value);
 
 void OSSL_sleep(uint64_t millis);
 
diff --git a/vendor/openssl/include/openssl/e_os2.h b/vendor/openssl/include/openssl/e_os2.h
index e01f627..a4aea0b 100644
--- a/vendor/openssl/include/openssl/e_os2.h
+++ b/vendor/openssl/include/openssl/e_os2.h
@@ -200,6 +200,7 @@ extern "C" {
 # endif
 
 # ifndef ossl_ssize_t
+#  include <sys/types.h>
 #  define ossl_ssize_t ssize_t
 #  if defined(SSIZE_MAX)
 #   define OSSL_SSIZE_MAX SSIZE_MAX
diff --git a/vendor/openssl/include/openssl/sslerr.h b/vendor/openssl/include/openssl/sslerr.h
index 980a6c7..8222b25 100644
--- a/vendor/openssl/include/openssl/sslerr.h
+++ b/vendor/openssl/include/openssl/sslerr.h
@@ -117,6 +117,7 @@
 # define SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST         354
 # define SSL_R_ENCRYPTED_LENGTH_TOO_LONG                  150
 # define SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST              151
+# define SSL_R_ERROR_IN_SYSTEM_DEFAULT_CONFIG             419
 # define SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN             204
 # define SSL_R_EXCEEDS_MAX_FRAGMENT_SIZE                  194
 # define SSL_R_EXCESSIVE_MESSAGE_SIZE                     152
@@ -308,10 +309,12 @@
 # define SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK         1086
 # define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY          1071
 # define SSL_R_TLSV1_ALERT_INTERNAL_ERROR                 1080
+# define SSL_R_TLSV1_ALERT_NO_APPLICATION_PROTOCOL        1120
 # define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION               1100
 # define SSL_R_TLSV1_ALERT_PROTOCOL_VERSION               1070
 # define SSL_R_TLSV1_ALERT_RECORD_OVERFLOW                1022
 # define SSL_R_TLSV1_ALERT_UNKNOWN_CA                     1048
+# define SSL_R_TLSV1_ALERT_UNKNOWN_PSK_IDENTITY           1115
 # define SSL_R_TLSV1_ALERT_USER_CANCELLED                 1090
 # define SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE           1114
 # define SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE      1113
diff --git a/vendor/openssl/include/openssl/tls1.h b/vendor/openssl/include/openssl/tls1.h
index 7e3d1a7..8ff39e3 100644
--- a/vendor/openssl/include/openssl/tls1.h
+++ b/vendor/openssl/include/openssl/tls1.h
@@ -622,6 +622,10 @@ int SSL_CTX_set_tlsext_ticket_key_evp_cb
 # define TLS1_3_CK_AES_128_CCM_SHA256                     0x03001304
 # define TLS1_3_CK_AES_128_CCM_8_SHA256                   0x03001305
 
+/* Integrity-only ciphersuites from RFC 9150 */
+# define TLS1_3_CK_SHA256_SHA256                          0x0300C0B4
+# define TLS1_3_CK_SHA384_SHA384                          0x0300C0B5
+
 /* Aria ciphersuites from RFC6209 */
 # define TLS1_CK_RSA_WITH_ARIA_128_GCM_SHA256             0x0300C050
 # define TLS1_CK_RSA_WITH_ARIA_256_GCM_SHA384             0x0300C051
@@ -699,6 +703,8 @@ int SSL_CTX_set_tlsext_ticket_key_evp_cb
 # define TLS1_3_RFC_AES_128_GCM_SHA256                   "TLS_AES_128_GCM_SHA256"
 # define TLS1_3_RFC_AES_256_GCM_SHA384                   "TLS_AES_256_GCM_SHA384"
 # define TLS1_3_RFC_CHACHA20_POLY1305_SHA256             "TLS_CHACHA20_POLY1305_SHA256"
+# define TLS1_3_RFC_SHA256_SHA256                        "TLS_SHA256_SHA256"
+# define TLS1_3_RFC_SHA384_SHA384                        "TLS_SHA384_SHA384"
 # define TLS1_3_RFC_AES_128_CCM_SHA256                   "TLS_AES_128_CCM_SHA256"
 # define TLS1_3_RFC_AES_128_CCM_8_SHA256                 "TLS_AES_128_CCM_8_SHA256"
 # define TLS1_RFC_ECDHE_ECDSA_WITH_NULL_SHA              "TLS_ECDHE_ECDSA_WITH_NULL_SHA"
diff --git a/vendor/openssl/include/openssl/x509v3.h.in b/vendor/openssl/include/openssl/x509v3.h.in
index b8711d5..a967064 100644
--- a/vendor/openssl/include/openssl/x509v3.h.in
+++ b/vendor/openssl/include/openssl/x509v3.h.in
@@ -178,6 +178,8 @@ typedef struct ACCESS_DESCRIPTION_st {
     GENERAL_NAME *location;
 } ACCESS_DESCRIPTION;
 
+int GENERAL_NAME_set1_X509_NAME(GENERAL_NAME **tgt, const X509_NAME *src);
+
 {-
     generate_stack_macros("ACCESS_DESCRIPTION")
     .generate_stack_macros("GENERAL_NAME");
@@ -201,6 +203,7 @@ typedef struct DIST_POINT_NAME_st {
 /* If relativename then this contains the full distribution point name */
     X509_NAME *dpname;
 } DIST_POINT_NAME;
+DECLARE_ASN1_DUP_FUNCTION(DIST_POINT_NAME)
 /* All existing reasons */
 # define CRLDP_ALL_REASONS       0x807f
 
diff --git a/vendor/secp256k1/include/secp256k1/secp256k1.h b/vendor/secp256k1/include/secp256k1/secp256k1.h
index f4053f2..cfbdd52 100644
--- a/vendor/secp256k1/include/secp256k1/secp256k1.h
+++ b/vendor/secp256k1/include/secp256k1/secp256k1.h
@@ -474,6 +474,20 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_cmp(
     const secp256k1_pubkey *pubkey2
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
+/** Sort public keys using lexicographic (of compressed serialization) order
+ *
+ *  Returns: 0 if the arguments are invalid. 1 otherwise.
+ *
+ *  Args:     ctx: pointer to a context object
+ *  In:   pubkeys: array of pointers to pubkeys to sort
+ *      n_pubkeys: number of elements in the pubkeys array
+ */
+SECP256K1_API int secp256k1_ec_pubkey_sort(
+    const secp256k1_context *ctx,
+    const secp256k1_pubkey **pubkeys,
+    size_t n_pubkeys
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2);
+
 /** Parse an ECDSA signature in compact (64 bytes) format.
  *
  *  Returns: 1 when the signature could be parsed, 0 otherwise.
diff --git a/vendor/secp256k1/include/secp256k1/secp256k1_extrakeys.h b/vendor/secp256k1/include/secp256k1/secp256k1_extrakeys.h
index 4cc6d4f..ad70b92 100644
--- a/vendor/secp256k1/include/secp256k1/secp256k1_extrakeys.h
+++ b/vendor/secp256k1/include/secp256k1/secp256k1_extrakeys.h
@@ -7,241 +7,241 @@
 extern "C" {
 #endif
 
-    /** Opaque data structure that holds a parsed and valid "x-only" public key.
-     *  An x-only pubkey encodes a point whose Y coordinate is even. It is
-     *  serialized using only its X coordinate (32 bytes). See BIP-340 for more
-     *  information about x-only pubkeys.
-     *
-     *  The exact representation of data inside is implementation defined and not
-     *  guaranteed to be portable between different platforms or versions. It is
-     *  however guaranteed to be 64 bytes in size, and can be safely copied/moved.
-     *  If you need to convert to a format suitable for storage, transmission, use
-     *  use secp256k1_xonly_pubkey_serialize and secp256k1_xonly_pubkey_parse. To
-     *  compare keys, use secp256k1_xonly_pubkey_cmp.
-     */
-    typedef struct {
-        unsigned char data[64];
-    } secp256k1_xonly_pubkey;
-
-    /** Opaque data structure that holds a keypair consisting of a secret and a
-     *  public key.
-     *
-     *  The exact representation of data inside is implementation defined and not
-     *  guaranteed to be portable between different platforms or versions. It is
-     *  however guaranteed to be 96 bytes in size, and can be safely copied/moved.
-     */
-    typedef struct {
-        unsigned char data[96];
-    } secp256k1_keypair;
-
-    /** Parse a 32-byte sequence into a xonly_pubkey object.
-     *
-     *  Returns: 1 if the public key was fully valid.
-     *           0 if the public key could not be parsed or is invalid.
-     *
-     *  Args:   ctx: pointer to a context object.
-     *  Out: pubkey: pointer to a pubkey object. If 1 is returned, it is set to a
-     *               parsed version of input. If not, it's set to an invalid value.
-     *  In: input32: pointer to a serialized xonly_pubkey.
-     */
-    SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_xonly_pubkey_parse(
-        const secp256k1_context* ctx,
-        secp256k1_xonly_pubkey* pubkey,
-        const unsigned char* input32
-    ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
-
-    /** Serialize an xonly_pubkey object into a 32-byte sequence.
-     *
-     *  Returns: 1 always.
-     *
-     *  Args:     ctx: pointer to a context object.
-     *  Out: output32: pointer to a 32-byte array to place the serialized key in.
-     *  In:    pubkey: pointer to a secp256k1_xonly_pubkey containing an initialized public key.
-     */
-    SECP256K1_API int secp256k1_xonly_pubkey_serialize(
-        const secp256k1_context* ctx,
-        unsigned char* output32,
-        const secp256k1_xonly_pubkey* pubkey
-    ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
-
-    /** Compare two x-only public keys using lexicographic order
-     *
-     *  Returns: <0 if the first public key is less than the second
-     *           >0 if the first public key is greater than the second
-     *           0 if the two public keys are equal
-     *  Args: ctx:      pointer to a context object.
-     *  In:   pubkey1:  first public key to compare
-     *        pubkey2:  second public key to compare
-     */
-    SECP256K1_API int secp256k1_xonly_pubkey_cmp(
-        const secp256k1_context* ctx,
-        const secp256k1_xonly_pubkey* pk1,
-        const secp256k1_xonly_pubkey* pk2
-    ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
-
-    /** Converts a secp256k1_pubkey into a secp256k1_xonly_pubkey.
-     *
-     *  Returns: 1 always.
-     *
-     *  Args:         ctx: pointer to a context object.
-     *  Out: xonly_pubkey: pointer to an x-only public key object for placing the converted public key.
-     *          pk_parity: Ignored if NULL. Otherwise, pointer to an integer that
-     *                     will be set to 1 if the point encoded by xonly_pubkey is
-     *                     the negation of the pubkey and set to 0 otherwise.
-     *  In:        pubkey: pointer to a public key that is converted.
-     */
-    SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_xonly_pubkey_from_pubkey(
-        const secp256k1_context* ctx,
-        secp256k1_xonly_pubkey* xonly_pubkey,
-        int* pk_parity,
-        const secp256k1_pubkey* pubkey
-    ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4);
-
-    /** Tweak an x-only public key by adding the generator multiplied with tweak32
-     *  to it.
-     *
-     *  Note that the resulting point can not in general be represented by an x-only
-     *  pubkey because it may have an odd Y coordinate. Instead, the output_pubkey
-     *  is a normal secp256k1_pubkey.
-     *
-     *  Returns: 0 if the arguments are invalid or the resulting public key would be
-     *           invalid (only when the tweak is the negation of the corresponding
-     *           secret key). 1 otherwise.
-     *
-     *  Args:           ctx: pointer to a context object.
-     *  Out:  output_pubkey: pointer to a public key to store the result. Will be set
-     *                       to an invalid value if this function returns 0.
-     *  In: internal_pubkey: pointer to an x-only pubkey to apply the tweak to.
-     *              tweak32: pointer to a 32-byte tweak, which must be valid
-     *                       according to secp256k1_ec_seckey_verify or 32 zero
-     *                       bytes. For uniformly random 32-byte tweaks, the chance of
-     *                       being invalid is negligible (around 1 in 2^128).
-     */
-    SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_xonly_pubkey_tweak_add(
-        const secp256k1_context* ctx,
-        secp256k1_pubkey* output_pubkey,
-        const secp256k1_xonly_pubkey* internal_pubkey,
-        const unsigned char* tweak32
-    ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
-
-    /** Checks that a tweaked pubkey is the result of calling
-     *  secp256k1_xonly_pubkey_tweak_add with internal_pubkey and tweak32.
-     *
-     *  The tweaked pubkey is represented by its 32-byte x-only serialization and
-     *  its pk_parity, which can both be obtained by converting the result of
-     *  tweak_add to a secp256k1_xonly_pubkey.
-     *
-     *  Note that this alone does _not_ verify that the tweaked pubkey is a
-     *  commitment. If the tweak is not chosen in a specific way, the tweaked pubkey
-     *  can easily be the result of a different internal_pubkey and tweak.
-     *
-     *  Returns: 0 if the arguments are invalid or the tweaked pubkey is not the
-     *           result of tweaking the internal_pubkey with tweak32. 1 otherwise.
-     *  Args:            ctx: pointer to a context object.
-     *  In: tweaked_pubkey32: pointer to a serialized xonly_pubkey.
-     *     tweaked_pk_parity: the parity of the tweaked pubkey (whose serialization
-     *                        is passed in as tweaked_pubkey32). This must match the
-     *                        pk_parity value that is returned when calling
-     *                        secp256k1_xonly_pubkey with the tweaked pubkey, or
-     *                        this function will fail.
-     *       internal_pubkey: pointer to an x-only public key object to apply the tweak to.
-     *               tweak32: pointer to a 32-byte tweak.
-     */
-    SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_xonly_pubkey_tweak_add_check(
-        const secp256k1_context* ctx,
-        const unsigned char* tweaked_pubkey32,
-        int tweaked_pk_parity,
-        const secp256k1_xonly_pubkey* internal_pubkey,
-        const unsigned char* tweak32
-    ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
-
-    /** Compute the keypair for a secret key.
-     *
-     *  Returns: 1: secret was valid, keypair is ready to use
-     *           0: secret was invalid, try again with a different secret
-     *  Args:    ctx: pointer to a context object (not secp256k1_context_static).
-     *  Out: keypair: pointer to the created keypair.
-     *  In:   seckey: pointer to a 32-byte secret key.
-     */
-    SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_create(
-        const secp256k1_context* ctx,
-        secp256k1_keypair* keypair,
-        const unsigned char* seckey
-    ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
-
-    /** Get the secret key from a keypair.
-     *
-     *  Returns: 1 always.
-     *  Args:   ctx: pointer to a context object.
-     *  Out: seckey: pointer to a 32-byte buffer for the secret key.
-     *  In: keypair: pointer to a keypair.
-     */
-    SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_sec(
-        const secp256k1_context* ctx,
-        unsigned char* seckey,
-        const secp256k1_keypair* keypair
-    ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
-
-    /** Get the public key from a keypair.
-     *
-     *  Returns: 1 always.
-     *  Args:   ctx: pointer to a context object.
-     *  Out: pubkey: pointer to a pubkey object, set to the keypair public key.
-     *  In: keypair: pointer to a keypair.
-     */
-    SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_pub(
-        const secp256k1_context* ctx,
-        secp256k1_pubkey* pubkey,
-        const secp256k1_keypair* keypair
-    ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
-
-    /** Get the x-only public key from a keypair.
-     *
-     *  This is the same as calling secp256k1_keypair_pub and then
-     *  secp256k1_xonly_pubkey_from_pubkey.
-     *
-     *  Returns: 1 always.
-     *  Args:   ctx: pointer to a context object.
-     *  Out: pubkey: pointer to an xonly_pubkey object, set to the keypair
-     *               public key after converting it to an xonly_pubkey.
-     *    pk_parity: Ignored if NULL. Otherwise, pointer to an integer that will be set to the
-     *               pk_parity argument of secp256k1_xonly_pubkey_from_pubkey.
-     *  In: keypair: pointer to a keypair.
-     */
-    SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_xonly_pub(
-        const secp256k1_context* ctx,
-        secp256k1_xonly_pubkey* pubkey,
-        int* pk_parity,
-        const secp256k1_keypair* keypair
-    ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4);
-
-    /** Tweak a keypair by adding tweak32 to the secret key and updating the public
-     *  key accordingly.
-     *
-     *  Calling this function and then secp256k1_keypair_pub results in the same
-     *  public key as calling secp256k1_keypair_xonly_pub and then
-     *  secp256k1_xonly_pubkey_tweak_add.
-     *
-     *  Returns: 0 if the arguments are invalid or the resulting keypair would be
-     *           invalid (only when the tweak is the negation of the keypair's
-     *           secret key). 1 otherwise.
-     *
-     *  Args:       ctx: pointer to a context object.
-     *  In/Out: keypair: pointer to a keypair to apply the tweak to. Will be set to
-     *                   an invalid value if this function returns 0.
-     *  In:     tweak32: pointer to a 32-byte tweak, which must be valid according to
-     *                   secp256k1_ec_seckey_verify or 32 zero bytes. For uniformly
-     *                   random 32-byte tweaks, the chance of being invalid is
-     *                   negligible (around 1 in 2^128).
-     */
-    SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_xonly_tweak_add(
-        const secp256k1_context* ctx,
-        secp256k1_keypair* keypair,
-        const unsigned char* tweak32
-    ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+/** Opaque data structure that holds a parsed and valid "x-only" public key.
+ *  An x-only pubkey encodes a point whose Y coordinate is even. It is
+ *  serialized using only its X coordinate (32 bytes). See BIP-340 for more
+ *  information about x-only pubkeys.
+ *
+ *  The exact representation of data inside is implementation defined and not
+ *  guaranteed to be portable between different platforms or versions. It is
+ *  however guaranteed to be 64 bytes in size, and can be safely copied/moved.
+ *  If you need to convert to a format suitable for storage, transmission, use
+ *  use secp256k1_xonly_pubkey_serialize and secp256k1_xonly_pubkey_parse. To
+ *  compare keys, use secp256k1_xonly_pubkey_cmp.
+ */
+typedef struct {
+    unsigned char data[64];
+} secp256k1_xonly_pubkey;
+
+/** Opaque data structure that holds a keypair consisting of a secret and a
+ *  public key.
+ *
+ *  The exact representation of data inside is implementation defined and not
+ *  guaranteed to be portable between different platforms or versions. It is
+ *  however guaranteed to be 96 bytes in size, and can be safely copied/moved.
+ */
+typedef struct {
+    unsigned char data[96];
+} secp256k1_keypair;
+
+/** Parse a 32-byte sequence into a xonly_pubkey object.
+ *
+ *  Returns: 1 if the public key was fully valid.
+ *           0 if the public key could not be parsed or is invalid.
+ *
+ *  Args:   ctx: pointer to a context object.
+ *  Out: pubkey: pointer to a pubkey object. If 1 is returned, it is set to a
+ *               parsed version of input. If not, it's set to an invalid value.
+ *  In: input32: pointer to a serialized xonly_pubkey.
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_xonly_pubkey_parse(
+    const secp256k1_context *ctx,
+    secp256k1_xonly_pubkey *pubkey,
+    const unsigned char *input32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Serialize an xonly_pubkey object into a 32-byte sequence.
+ *
+ *  Returns: 1 always.
+ *
+ *  Args:     ctx: pointer to a context object.
+ *  Out: output32: pointer to a 32-byte array to place the serialized key in.
+ *  In:    pubkey: pointer to a secp256k1_xonly_pubkey containing an initialized public key.
+ */
+SECP256K1_API int secp256k1_xonly_pubkey_serialize(
+    const secp256k1_context *ctx,
+    unsigned char *output32,
+    const secp256k1_xonly_pubkey *pubkey
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Compare two x-only public keys using lexicographic order
+ *
+ *  Returns: <0 if the first public key is less than the second
+ *           >0 if the first public key is greater than the second
+ *           0 if the two public keys are equal
+ *  Args: ctx:      pointer to a context object.
+ *  In:   pubkey1:  first public key to compare
+ *        pubkey2:  second public key to compare
+ */
+SECP256K1_API int secp256k1_xonly_pubkey_cmp(
+    const secp256k1_context *ctx,
+    const secp256k1_xonly_pubkey *pk1,
+    const secp256k1_xonly_pubkey *pk2
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Converts a secp256k1_pubkey into a secp256k1_xonly_pubkey.
+ *
+ *  Returns: 1 always.
+ *
+ *  Args:         ctx: pointer to a context object.
+ *  Out: xonly_pubkey: pointer to an x-only public key object for placing the converted public key.
+ *          pk_parity: Ignored if NULL. Otherwise, pointer to an integer that
+ *                     will be set to 1 if the point encoded by xonly_pubkey is
+ *                     the negation of the pubkey and set to 0 otherwise.
+ *  In:        pubkey: pointer to a public key that is converted.
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_xonly_pubkey_from_pubkey(
+    const secp256k1_context *ctx,
+    secp256k1_xonly_pubkey *xonly_pubkey,
+    int *pk_parity,
+    const secp256k1_pubkey *pubkey
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4);
+
+/** Tweak an x-only public key by adding the generator multiplied with tweak32
+ *  to it.
+ *
+ *  Note that the resulting point can not in general be represented by an x-only
+ *  pubkey because it may have an odd Y coordinate. Instead, the output_pubkey
+ *  is a normal secp256k1_pubkey.
+ *
+ *  Returns: 0 if the arguments are invalid or the resulting public key would be
+ *           invalid (only when the tweak is the negation of the corresponding
+ *           secret key). 1 otherwise.
+ *
+ *  Args:           ctx: pointer to a context object.
+ *  Out:  output_pubkey: pointer to a public key to store the result. Will be set
+ *                       to an invalid value if this function returns 0.
+ *  In: internal_pubkey: pointer to an x-only pubkey to apply the tweak to.
+ *              tweak32: pointer to a 32-byte tweak, which must be valid
+ *                       according to secp256k1_ec_seckey_verify or 32 zero
+ *                       bytes. For uniformly random 32-byte tweaks, the chance of
+ *                       being invalid is negligible (around 1 in 2^128).
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_xonly_pubkey_tweak_add(
+    const secp256k1_context *ctx,
+    secp256k1_pubkey *output_pubkey,
+    const secp256k1_xonly_pubkey *internal_pubkey,
+    const unsigned char *tweak32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+
+/** Checks that a tweaked pubkey is the result of calling
+ *  secp256k1_xonly_pubkey_tweak_add with internal_pubkey and tweak32.
+ *
+ *  The tweaked pubkey is represented by its 32-byte x-only serialization and
+ *  its pk_parity, which can both be obtained by converting the result of
+ *  tweak_add to a secp256k1_xonly_pubkey.
+ *
+ *  Note that this alone does _not_ verify that the tweaked pubkey is a
+ *  commitment. If the tweak is not chosen in a specific way, the tweaked pubkey
+ *  can easily be the result of a different internal_pubkey and tweak.
+ *
+ *  Returns: 0 if the arguments are invalid or the tweaked pubkey is not the
+ *           result of tweaking the internal_pubkey with tweak32. 1 otherwise.
+ *  Args:            ctx: pointer to a context object.
+ *  In: tweaked_pubkey32: pointer to a serialized xonly_pubkey.
+ *     tweaked_pk_parity: the parity of the tweaked pubkey (whose serialization
+ *                        is passed in as tweaked_pubkey32). This must match the
+ *                        pk_parity value that is returned when calling
+ *                        secp256k1_xonly_pubkey with the tweaked pubkey, or
+ *                        this function will fail.
+ *       internal_pubkey: pointer to an x-only public key object to apply the tweak to.
+ *               tweak32: pointer to a 32-byte tweak.
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_xonly_pubkey_tweak_add_check(
+    const secp256k1_context *ctx,
+    const unsigned char *tweaked_pubkey32,
+    int tweaked_pk_parity,
+    const secp256k1_xonly_pubkey *internal_pubkey,
+    const unsigned char *tweak32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
+
+/** Compute the keypair for a secret key.
+ *
+ *  Returns: 1: secret was valid, keypair is ready to use
+ *           0: secret was invalid, try again with a different secret
+ *  Args:    ctx: pointer to a context object (not secp256k1_context_static).
+ *  Out: keypair: pointer to the created keypair.
+ *  In:   seckey: pointer to a 32-byte secret key.
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_create(
+    const secp256k1_context *ctx,
+    secp256k1_keypair *keypair,
+    const unsigned char *seckey
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Get the secret key from a keypair.
+ *
+ *  Returns: 1 always.
+ *  Args:   ctx: pointer to a context object.
+ *  Out: seckey: pointer to a 32-byte buffer for the secret key.
+ *  In: keypair: pointer to a keypair.
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_sec(
+    const secp256k1_context *ctx,
+    unsigned char *seckey,
+    const secp256k1_keypair *keypair
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Get the public key from a keypair.
+ *
+ *  Returns: 1 always.
+ *  Args:   ctx: pointer to a context object.
+ *  Out: pubkey: pointer to a pubkey object, set to the keypair public key.
+ *  In: keypair: pointer to a keypair.
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_pub(
+    const secp256k1_context *ctx,
+    secp256k1_pubkey *pubkey,
+    const secp256k1_keypair *keypair
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Get the x-only public key from a keypair.
+ *
+ *  This is the same as calling secp256k1_keypair_pub and then
+ *  secp256k1_xonly_pubkey_from_pubkey.
+ *
+ *  Returns: 1 always.
+ *  Args:   ctx: pointer to a context object.
+ *  Out: pubkey: pointer to an xonly_pubkey object, set to the keypair
+ *               public key after converting it to an xonly_pubkey.
+ *    pk_parity: Ignored if NULL. Otherwise, pointer to an integer that will be set to the
+ *               pk_parity argument of secp256k1_xonly_pubkey_from_pubkey.
+ *  In: keypair: pointer to a keypair.
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_xonly_pub(
+    const secp256k1_context *ctx,
+    secp256k1_xonly_pubkey *pubkey,
+    int *pk_parity,
+    const secp256k1_keypair *keypair
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4);
+
+/** Tweak a keypair by adding tweak32 to the secret key and updating the public
+ *  key accordingly.
+ *
+ *  Calling this function and then secp256k1_keypair_pub results in the same
+ *  public key as calling secp256k1_keypair_xonly_pub and then
+ *  secp256k1_xonly_pubkey_tweak_add.
+ *
+ *  Returns: 0 if the arguments are invalid or the resulting keypair would be
+ *           invalid (only when the tweak is the negation of the keypair's
+ *           secret key). 1 otherwise.
+ *
+ *  Args:       ctx: pointer to a context object.
+ *  In/Out: keypair: pointer to a keypair to apply the tweak to. Will be set to
+ *                   an invalid value if this function returns 0.
+ *  In:     tweak32: pointer to a 32-byte tweak, which must be valid according to
+ *                   secp256k1_ec_seckey_verify or 32 zero bytes. For uniformly
+ *                   random 32-byte tweaks, the chance of being invalid is
+ *                   negligible (around 1 in 2^128).
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_xonly_tweak_add(
+    const secp256k1_context *ctx,
+    secp256k1_keypair *keypair,
+    const unsigned char *tweak32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
 #ifdef __cplusplus
 }
 #endif
 
-#endif /* SECP256K1_EXTRAKEYS_H */
\ No newline at end of file
+#endif /* SECP256K1_EXTRAKEYS_H */
diff --git a/vendor/secp256k1/include/secp256k1/secp256k1_preallocated.h b/vendor/secp256k1/include/secp256k1/secp256k1_preallocated.h
new file mode 100644
index 0000000..f2d95c2
--- /dev/null
+++ b/vendor/secp256k1/include/secp256k1/secp256k1_preallocated.h
@@ -0,0 +1,134 @@
+#ifndef SECP256K1_PREALLOCATED_H
+#define SECP256K1_PREALLOCATED_H
+
+#include "secp256k1.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* The module provided by this header file is intended for settings in which it
+ * is not possible or desirable to rely on dynamic memory allocation. It provides
+ * functions for creating, cloning, and destroying secp256k1 context objects in a
+ * contiguous fixed-size block of memory provided by the caller.
+ *
+ * Context objects created by functions in this module can be used like contexts
+ * objects created by functions in secp256k1.h, i.e., they can be passed to any
+ * API function that expects a context object (see secp256k1.h for details). The
+ * only exception is that context objects created by functions in this module
+ * must be destroyed using secp256k1_context_preallocated_destroy (in this
+ * module) instead of secp256k1_context_destroy (in secp256k1.h).
+ *
+ * It is guaranteed that functions in this module will not call malloc or its
+ * friends realloc, calloc, and free.
+ */
+
+/** Determine the memory size of a secp256k1 context object to be created in
+ *  caller-provided memory.
+ *
+ *  The purpose of this function is to determine how much memory must be provided
+ *  to secp256k1_context_preallocated_create.
+ *
+ *  Returns: the required size of the caller-provided memory block
+ *  In:      flags:    which parts of the context to initialize.
+ */
+SECP256K1_API size_t secp256k1_context_preallocated_size(
+    unsigned int flags
+) SECP256K1_WARN_UNUSED_RESULT;
+
+/** Create a secp256k1 context object in caller-provided memory.
+ *
+ *  The caller must provide a pointer to a rewritable contiguous block of memory
+ *  of size at least secp256k1_context_preallocated_size(flags) bytes, suitably
+ *  aligned to hold an object of any type.
+ *
+ *  The block of memory is exclusively owned by the created context object during
+ *  the lifetime of this context object, which begins with the call to this
+ *  function and ends when a call to secp256k1_context_preallocated_destroy
+ *  (which destroys the context object again) returns. During the lifetime of the
+ *  context object, the caller is obligated not to access this block of memory,
+ *  i.e., the caller may not read or write the memory, e.g., by copying the memory
+ *  contents to a different location or trying to create a second context object
+ *  in the memory. In simpler words, the prealloc pointer (or any pointer derived
+ *  from it) should not be used during the lifetime of the context object.
+ *
+ *  Returns: pointer to newly created context object.
+ *  In:      prealloc: pointer to a rewritable contiguous block of memory of
+ *                     size at least secp256k1_context_preallocated_size(flags)
+ *                     bytes, as detailed above.
+ *           flags:    which parts of the context to initialize.
+ *
+ *  See secp256k1_context_create (in secp256k1.h) for further details.
+ *
+ *  See also secp256k1_context_randomize (in secp256k1.h)
+ *  and secp256k1_context_preallocated_destroy.
+ */
+SECP256K1_API secp256k1_context *secp256k1_context_preallocated_create(
+    void *prealloc,
+    unsigned int flags
+) SECP256K1_ARG_NONNULL(1) SECP256K1_WARN_UNUSED_RESULT;
+
+/** Determine the memory size of a secp256k1 context object to be copied into
+ *  caller-provided memory.
+ *
+ *  Returns: the required size of the caller-provided memory block.
+ *  In:      ctx: pointer to a context to copy.
+ */
+SECP256K1_API size_t secp256k1_context_preallocated_clone_size(
+    const secp256k1_context *ctx
+) SECP256K1_ARG_NONNULL(1) SECP256K1_WARN_UNUSED_RESULT;
+
+/** Copy a secp256k1 context object into caller-provided memory.
+ *
+ *  The caller must provide a pointer to a rewritable contiguous block of memory
+ *  of size at least secp256k1_context_preallocated_size(flags) bytes, suitably
+ *  aligned to hold an object of any type.
+ *
+ *  The block of memory is exclusively owned by the created context object during
+ *  the lifetime of this context object, see the description of
+ *  secp256k1_context_preallocated_create for details.
+ *
+ *  Cloning secp256k1_context_static is not possible, and should not be emulated by
+ *  the caller (e.g., using memcpy). Create a new context instead.
+ *
+ *  Returns: pointer to a newly created context object.
+ *  Args:    ctx:      pointer to a context to copy (not secp256k1_context_static).
+ *  In:      prealloc: pointer to a rewritable contiguous block of memory of
+ *                     size at least secp256k1_context_preallocated_size(flags)
+ *                     bytes, as detailed above.
+ */
+SECP256K1_API secp256k1_context *secp256k1_context_preallocated_clone(
+    const secp256k1_context *ctx,
+    void *prealloc
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_WARN_UNUSED_RESULT;
+
+/** Destroy a secp256k1 context object that has been created in
+ *  caller-provided memory.
+ *
+ *  The context pointer may not be used afterwards.
+ *
+ *  The context to destroy must have been created using
+ *  secp256k1_context_preallocated_create or secp256k1_context_preallocated_clone.
+ *  If the context has instead been created using secp256k1_context_create or
+ *  secp256k1_context_clone, the behaviour is undefined. In that case,
+ *  secp256k1_context_destroy must be used instead.
+ *
+ *  If required, it is the responsibility of the caller to deallocate the block
+ *  of memory properly after this function returns, e.g., by calling free on the
+ *  preallocated pointer given to secp256k1_context_preallocated_create or
+ *  secp256k1_context_preallocated_clone.
+ *
+ *  Args:   ctx: pointer to a context to destroy, constructed using
+ *               secp256k1_context_preallocated_create or
+ *               secp256k1_context_preallocated_clone
+ *               (i.e., not secp256k1_context_static).
+ */
+SECP256K1_API void secp256k1_context_preallocated_destroy(
+    secp256k1_context *ctx
+) SECP256K1_ARG_NONNULL(1);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* SECP256K1_PREALLOCATED_H */
diff --git a/vendor/secp256k1/include/secp256k1/secp256k1_schnorrsig.h b/vendor/secp256k1/include/secp256k1/secp256k1_schnorrsig.h
index 5c338f4..23163de 100644
--- a/vendor/secp256k1/include/secp256k1/secp256k1_schnorrsig.h
+++ b/vendor/secp256k1/include/secp256k1/secp256k1_schnorrsig.h
@@ -8,82 +8,82 @@
 extern "C" {
 #endif
 
-    /** This module implements a variant of Schnorr signatures compliant with
-     *  Bitcoin Improvement Proposal 340 "Schnorr Signatures for secp256k1"
-     *  (https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki).
-     */
+/** This module implements a variant of Schnorr signatures compliant with
+ *  Bitcoin Improvement Proposal 340 "Schnorr Signatures for secp256k1"
+ *  (https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki).
+ */
 
-     /** A pointer to a function to deterministically generate a nonce.
-      *
-      *  Same as secp256k1_nonce function with the exception of accepting an
-      *  additional pubkey argument and not requiring an attempt argument. The pubkey
-      *  argument can protect signature schemes with key-prefixed challenge hash
-      *  inputs against reusing the nonce when signing with the wrong precomputed
-      *  pubkey.
-      *
-      *  Returns: 1 if a nonce was successfully generated. 0 will cause signing to
-      *           return an error.
-      *  Out:  nonce32: pointer to a 32-byte array to be filled by the function
-      *  In:       msg: the message being verified. Is NULL if and only if msglen
-      *                 is 0.
-      *         msglen: the length of the message
-      *          key32: pointer to a 32-byte secret key (will not be NULL)
-      *     xonly_pk32: the 32-byte serialized xonly pubkey corresponding to key32
-      *                 (will not be NULL)
-      *           algo: pointer to an array describing the signature
-      *                 algorithm (will not be NULL)
-      *        algolen: the length of the algo array
-      *           data: arbitrary data pointer that is passed through
-      *
-      *  Except for test cases, this function should compute some cryptographic hash of
-      *  the message, the key, the pubkey, the algorithm description, and data.
-      */
-    typedef int (*secp256k1_nonce_function_hardened)(
-        unsigned char* nonce32,
-        const unsigned char* msg,
-        size_t msglen,
-        const unsigned char* key32,
-        const unsigned char* xonly_pk32,
-        const unsigned char* algo,
-        size_t algolen,
-        void* data
-        );
+/** A pointer to a function to deterministically generate a nonce.
+ *
+ *  Same as secp256k1_nonce function with the exception of accepting an
+ *  additional pubkey argument and not requiring an attempt argument. The pubkey
+ *  argument can protect signature schemes with key-prefixed challenge hash
+ *  inputs against reusing the nonce when signing with the wrong precomputed
+ *  pubkey.
+ *
+ *  Returns: 1 if a nonce was successfully generated. 0 will cause signing to
+ *           return an error.
+ *  Out:  nonce32: pointer to a 32-byte array to be filled by the function
+ *  In:       msg: the message being verified. Is NULL if and only if msglen
+ *                 is 0.
+ *         msglen: the length of the message
+ *          key32: pointer to a 32-byte secret key (will not be NULL)
+ *     xonly_pk32: the 32-byte serialized xonly pubkey corresponding to key32
+ *                 (will not be NULL)
+ *           algo: pointer to an array describing the signature
+ *                 algorithm (will not be NULL)
+ *        algolen: the length of the algo array
+ *           data: arbitrary data pointer that is passed through
+ *
+ *  Except for test cases, this function should compute some cryptographic hash of
+ *  the message, the key, the pubkey, the algorithm description, and data.
+ */
+typedef int (*secp256k1_nonce_function_hardened)(
+    unsigned char *nonce32,
+    const unsigned char *msg,
+    size_t msglen,
+    const unsigned char *key32,
+    const unsigned char *xonly_pk32,
+    const unsigned char *algo,
+    size_t algolen,
+    void *data
+);
 
-    /** An implementation of the nonce generation function as defined in Bitcoin
-     *  Improvement Proposal 340 "Schnorr Signatures for secp256k1"
-     *  (https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki).
-     *
-     *  If a data pointer is passed, it is assumed to be a pointer to 32 bytes of
-     *  auxiliary random data as defined in BIP-340. If the data pointer is NULL,
-     *  the nonce derivation procedure follows BIP-340 by setting the auxiliary
-     *  random data to zero. The algo argument must be non-NULL, otherwise the
-     *  function will fail and return 0. The hash will be tagged with algo.
-     *  Therefore, to create BIP-340 compliant signatures, algo must be set to
-     *  "BIP0340/nonce" and algolen to 13.
-     */
-    SECP256K1_API const secp256k1_nonce_function_hardened secp256k1_nonce_function_bip340;
+/** An implementation of the nonce generation function as defined in Bitcoin
+ *  Improvement Proposal 340 "Schnorr Signatures for secp256k1"
+ *  (https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki).
+ *
+ *  If a data pointer is passed, it is assumed to be a pointer to 32 bytes of
+ *  auxiliary random data as defined in BIP-340. If the data pointer is NULL,
+ *  the nonce derivation procedure follows BIP-340 by setting the auxiliary
+ *  random data to zero. The algo argument must be non-NULL, otherwise the
+ *  function will fail and return 0. The hash will be tagged with algo.
+ *  Therefore, to create BIP-340 compliant signatures, algo must be set to
+ *  "BIP0340/nonce" and algolen to 13.
+ */
+SECP256K1_API const secp256k1_nonce_function_hardened secp256k1_nonce_function_bip340;
 
-    /** Data structure that contains additional arguments for schnorrsig_sign_custom.
-     *
-     *  A schnorrsig_extraparams structure object can be initialized correctly by
-     *  setting it to SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT.
-     *
-     *  Members:
-     *      magic: set to SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC at initialization
-     *             and has no other function than making sure the object is
-     *             initialized.
-     *    noncefp: pointer to a nonce generation function. If NULL,
-     *             secp256k1_nonce_function_bip340 is used
-     *      ndata: pointer to arbitrary data used by the nonce generation function
-     *             (can be NULL). If it is non-NULL and
-     *             secp256k1_nonce_function_bip340 is used, then ndata must be a
-     *             pointer to 32-byte auxiliary randomness as per BIP-340.
-     */
-    typedef struct {
-        unsigned char magic[4];
-        secp256k1_nonce_function_hardened noncefp;
-        void* ndata;
-    } secp256k1_schnorrsig_extraparams;
+/** Data structure that contains additional arguments for schnorrsig_sign_custom.
+ *
+ *  A schnorrsig_extraparams structure object can be initialized correctly by
+ *  setting it to SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT.
+ *
+ *  Members:
+ *      magic: set to SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC at initialization
+ *             and has no other function than making sure the object is
+ *             initialized.
+ *    noncefp: pointer to a nonce generation function. If NULL,
+ *             secp256k1_nonce_function_bip340 is used
+ *      ndata: pointer to arbitrary data used by the nonce generation function
+ *             (can be NULL). If it is non-NULL and
+ *             secp256k1_nonce_function_bip340 is used, then ndata must be a
+ *             pointer to 32-byte auxiliary randomness as per BIP-340.
+ */
+typedef struct {
+    unsigned char magic[4];
+    secp256k1_nonce_function_hardened noncefp;
+    void *ndata;
+} secp256k1_schnorrsig_extraparams;
 
 #define SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC { 0xda, 0x6f, 0xb3, 0x8c }
 #define SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT {\
@@ -92,96 +92,96 @@ extern "C" {
     NULL\
 }
 
-    /** Create a Schnorr signature.
-     *
-     *  Does _not_ strictly follow BIP-340 because it does not verify the resulting
-     *  signature. Instead, you can manually use secp256k1_schnorrsig_verify and
-     *  abort if it fails.
-     *
-     *  This function only signs 32-byte messages. If you have messages of a
-     *  different size (or the same size but without a context-specific tag
-     *  prefix), it is recommended to create a 32-byte message hash with
-     *  secp256k1_tagged_sha256 and then sign the hash. Tagged hashing allows
-     *  providing an context-specific tag for domain separation. This prevents
-     *  signatures from being valid in multiple contexts by accident.
-     *
-     *  Returns 1 on success, 0 on failure.
-     *  Args:    ctx: pointer to a context object (not secp256k1_context_static).
-     *  Out:   sig64: pointer to a 64-byte array to store the serialized signature.
-     *  In:    msg32: the 32-byte message being signed.
-     *       keypair: pointer to an initialized keypair.
-     *    aux_rand32: 32 bytes of fresh randomness. While recommended to provide
-     *                this, it is only supplemental to security and can be NULL. A
-     *                NULL argument is treated the same as an all-zero one. See
-     *                BIP-340 "Default Signing" for a full explanation of this
-     *                argument and for guidance if randomness is expensive.
-     */
-    SECP256K1_API int secp256k1_schnorrsig_sign32(
-        const secp256k1_context* ctx,
-        unsigned char* sig64,
-        const unsigned char* msg32,
-        const secp256k1_keypair* keypair,
-        const unsigned char* aux_rand32
-    ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+/** Create a Schnorr signature.
+ *
+ *  Does _not_ strictly follow BIP-340 because it does not verify the resulting
+ *  signature. Instead, you can manually use secp256k1_schnorrsig_verify and
+ *  abort if it fails.
+ *
+ *  This function only signs 32-byte messages. If you have messages of a
+ *  different size (or the same size but without a context-specific tag
+ *  prefix), it is recommended to create a 32-byte message hash with
+ *  secp256k1_tagged_sha256 and then sign the hash. Tagged hashing allows
+ *  providing an context-specific tag for domain separation. This prevents
+ *  signatures from being valid in multiple contexts by accident.
+ *
+ *  Returns 1 on success, 0 on failure.
+ *  Args:    ctx: pointer to a context object (not secp256k1_context_static).
+ *  Out:   sig64: pointer to a 64-byte array to store the serialized signature.
+ *  In:    msg32: the 32-byte message being signed.
+ *       keypair: pointer to an initialized keypair.
+ *    aux_rand32: 32 bytes of fresh randomness. While recommended to provide
+ *                this, it is only supplemental to security and can be NULL. A
+ *                NULL argument is treated the same as an all-zero one. See
+ *                BIP-340 "Default Signing" for a full explanation of this
+ *                argument and for guidance if randomness is expensive.
+ */
+SECP256K1_API int secp256k1_schnorrsig_sign32(
+    const secp256k1_context *ctx,
+    unsigned char *sig64,
+    const unsigned char *msg32,
+    const secp256k1_keypair *keypair,
+    const unsigned char *aux_rand32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
 
-    /** Same as secp256k1_schnorrsig_sign32, but DEPRECATED. Will be removed in
-     *  future versions. */
-    SECP256K1_API int secp256k1_schnorrsig_sign(
-        const secp256k1_context* ctx,
-        unsigned char* sig64,
-        const unsigned char* msg32,
-        const secp256k1_keypair* keypair,
-        const unsigned char* aux_rand32
-    ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
-        SECP256K1_DEPRECATED("Use secp256k1_schnorrsig_sign32 instead");
+/** Same as secp256k1_schnorrsig_sign32, but DEPRECATED. Will be removed in
+ *  future versions. */
+SECP256K1_API int secp256k1_schnorrsig_sign(
+    const secp256k1_context *ctx,
+    unsigned char *sig64,
+    const unsigned char *msg32,
+    const secp256k1_keypair *keypair,
+    const unsigned char *aux_rand32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
+  SECP256K1_DEPRECATED("Use secp256k1_schnorrsig_sign32 instead");
 
-    /** Create a Schnorr signature with a more flexible API.
-     *
-     *  Same arguments as secp256k1_schnorrsig_sign except that it allows signing
-     *  variable length messages and accepts a pointer to an extraparams object that
-     *  allows customizing signing by passing additional arguments.
-     *
-     *  Equivalent to secp256k1_schnorrsig_sign32(..., aux_rand32) if msglen is 32
-     *  and extraparams is initialized as follows:
-     *  ```
-     *  secp256k1_schnorrsig_extraparams extraparams = SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT;
-     *  extraparams.ndata = (unsigned char*)aux_rand32;
-     *  ```
-     *
-     *  Returns 1 on success, 0 on failure.
-     *  Args:   ctx: pointer to a context object (not secp256k1_context_static).
-     *  Out:  sig64: pointer to a 64-byte array to store the serialized signature.
-     *  In:     msg: the message being signed. Can only be NULL if msglen is 0.
-     *       msglen: length of the message.
-     *      keypair: pointer to an initialized keypair.
-     *  extraparams: pointer to an extraparams object (can be NULL).
-     */
-    SECP256K1_API int secp256k1_schnorrsig_sign_custom(
-        const secp256k1_context* ctx,
-        unsigned char* sig64,
-        const unsigned char* msg,
-        size_t msglen,
-        const secp256k1_keypair* keypair,
-        secp256k1_schnorrsig_extraparams* extraparams
-    ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(5);
+/** Create a Schnorr signature with a more flexible API.
+ *
+ *  Same arguments as secp256k1_schnorrsig_sign except that it allows signing
+ *  variable length messages and accepts a pointer to an extraparams object that
+ *  allows customizing signing by passing additional arguments.
+ *
+ *  Equivalent to secp256k1_schnorrsig_sign32(..., aux_rand32) if msglen is 32
+ *  and extraparams is initialized as follows:
+ *  ```
+ *  secp256k1_schnorrsig_extraparams extraparams = SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT;
+ *  extraparams.ndata = (unsigned char*)aux_rand32;
+ *  ```
+ *
+ *  Returns 1 on success, 0 on failure.
+ *  Args:   ctx: pointer to a context object (not secp256k1_context_static).
+ *  Out:  sig64: pointer to a 64-byte array to store the serialized signature.
+ *  In:     msg: the message being signed. Can only be NULL if msglen is 0.
+ *       msglen: length of the message.
+ *      keypair: pointer to an initialized keypair.
+ *  extraparams: pointer to an extraparams object (can be NULL).
+ */
+SECP256K1_API int secp256k1_schnorrsig_sign_custom(
+    const secp256k1_context *ctx,
+    unsigned char *sig64,
+    const unsigned char *msg,
+    size_t msglen,
+    const secp256k1_keypair *keypair,
+    secp256k1_schnorrsig_extraparams *extraparams
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(5);
 
-    /** Verify a Schnorr signature.
-     *
-     *  Returns: 1: correct signature
-     *           0: incorrect signature
-     *  Args:    ctx: pointer to a context object.
-     *  In:    sig64: pointer to the 64-byte signature to verify.
-     *           msg: the message being verified. Can only be NULL if msglen is 0.
-     *        msglen: length of the message
-     *        pubkey: pointer to an x-only public key to verify with
-     */
-    SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorrsig_verify(
-        const secp256k1_context* ctx,
-        const unsigned char* sig64,
-        const unsigned char* msg,
-        size_t msglen,
-        const secp256k1_xonly_pubkey* pubkey
-    ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(5);
+/** Verify a Schnorr signature.
+ *
+ *  Returns: 1: correct signature
+ *           0: incorrect signature
+ *  Args:    ctx: pointer to a context object.
+ *  In:    sig64: pointer to the 64-byte signature to verify.
+ *           msg: the message being verified. Can only be NULL if msglen is 0.
+ *        msglen: length of the message
+ *        pubkey: pointer to an x-only public key to verify with
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorrsig_verify(
+    const secp256k1_context *ctx,
+    const unsigned char *sig64,
+    const unsigned char *msg,
+    size_t msglen,
+    const secp256k1_xonly_pubkey *pubkey
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(5);
 
 #ifdef __cplusplus
 }