Correct the input to H⊛ used to derive the nonce r in RedDSA.Sign, from T || M to T || _vk_ || M. This matches the sapling-crypto implementation; the spec was unintentionally changed in 2018.0-beta-20.
Correct the input to H⊛ used to derive the nonce r in RedDSA.Sign, from T || M to T || _vk_ || M.
This matches the sapling-crypto implementation; the spec was unintentionally changed in 2018.0-beta-20.

Signed-off-by: Daira Hopwood <cd7d43d5556a38ce626d53826fddc46adc597539@jacaranda.org>

zcash/zips,zcash/zips,zcash/zips,zcash/zips