The RFC suggests root||pubseed (in algorithm 10); note that
this choice does not influence interoperability.
Thanks go to Rafael Misoczki for bringing this up.
This ensures that xmss_core and xmss_core_fast offer the same API.
Note that xmss_core_fast still needs a major refactor, and this
wrapper is not exactly very clean. There is a considerable chance
this refactor will change the format of the state in the secret key.
Previous code allocated an array on the stack of mlen bytes, but
it should be possible to also sign heap-space messages. By relying
on the fact that sm and m fit the message + signature, we move
the message so that 4*n bytes of prefix can be added.
This allows different backends to store additional state information
in the secret key while the rest of the codebase remains agnostic.
In particular, this prepares for a common xmss_core.h API for both
the standard and the BDS-traversal-based implementations.
