[gavinhoward]

The author of the paper knows about bitslicing [1], so not mentioning it seems deliberate.

My guess is that bitslicing only gets you so far.

[1]: https://bearssl.org/constanttime.html#bitslicing