[paconbork]

Why not just use Ristretto with Curve25519 to avoid cofactor issues?

[cryptoquick]

Ristretto adds complexity over just using secp256k1, which also has very good Rust support, is quite fast and well-optimized, compiles to WASM, and supports ECDSA, ECDH, and Schnorr key aggregation, so it's quite full-featured.