[Cfrg] On h2c implementation

[Watson Ladd <[e-mail]>]

Dear all,

Recently one of my colleagues ran into some unexpected difficulties in
implementing the hash to curve draft. The underlying curve implementation
did not implement general purpose field arithmetic, but rather carried out
enough reduction at each step to be able to multiply a small number of
summands, and only at the end fully reduced.

This is a common way to avoid the cost of a full carry chain, but has the
disadvantage that the arithmetic functions need to be wrapped to properly
carry out comparisons to constants.

It may be worth calling this out in the document.

Sincerely,
Watson