Supporting ECDSA P-384 or P-521 signatures in Golang is unsafe

[coruus]

At the moment, neither P-384 nor P-521 have constant-time implementations in Go.

Because signature private keys are used repeatedly, it is unsafe to use either of these curves (unfortunately w.r.t. the twist-secure P-384).

See golang/go#11499.