There is some disagreement about how to deal with hash values larger
than the curve order size. We choose to follow OpenSSL's lead here.

R=bradfitzgo, r
CC=golang-dev
https://golang.org/cl/4273059