1) Elligator inversion fails on 0.  Also there may be corner cases
here which ought to be probed but are a pain, such as sqrt(id/(1-d))
and similar.

2) Elligator doesn't return the right hint, because I haven't coded
the rotation hints.  Probable solution: make Elligator not return a
hint, because there's no realistic scenario where it's useful anyway.
Alternative possible solution: can compute the right hint, but why
bother?

3) Elligator inversion doesn't set the high bit of the buffer at
random, because 2^255-19 isn't close to 2^256.  Possible solution:
preserve the high bit(s) of the buffer?

4) Elligator doesn't map [1] to the identity, I think.

5) Not enough corner case testing.

6) Probably some other non-Elligator problems