secp256k1_context_set_sha256_compression (include/secp256k1.h) does not say that the supplied function hashes secret data. It does: it hashes the secret key, or a value masked with it, when deriving RFC 6979, BIP340 and MuSig nonces, and the seed of the ecmult_gen blinding. A function that is not constant-time, or that logs or keeps its input, therefore breaks the library's constant-time and memory-clearing properties.
Could the header say that the function processes secret keys and nonces, must run in constant time with respect to its input, and must not keep or log it? I can open the pull request if that wording suits you.
Assisted-by: my usual tools (LLM, Internet, computer). Mistakes are mine.
