Table-based basepoint multiply optimizations for ntor handshake
If you know in advance that you'll be performing a large number of scalar multiplications by a given point, you can have an optimized implementation of the scalar multiply optimization. (Adam Langley explains this better than I am likely to do in this ticket description.) We can take advantage of this in a more-obvious way and a less obvious way.
The obvious place to use this is when we're multiplying by a basepoint in order to generate ephemeral keys. There are a few implementations of this technique in libraries we're already talking about; see https://github.com/floodyberry/ed25519-donna for one example.