Replace `subtle` with `ctutils`?

[newpavlov]

See RustCrypto/meta#29

In particular, subtle is part of the digest public API via the CtOutput type. elliptic-curve also uses it as a dependency. We probably should migrate before cutting the next breaking release.

[tarcieri]

It continues to be a big part of the public API of elliptic-curve because ff/group use it: zkcrypto/ff#148

I was hoping to come to come kind of consensus about what to do there but haven't heard back yet.

[newpavlov]

WDYT about digest? Should we migrate it before the next release or wait for decision on elliptic-curve?

[tarcieri]

Yeah, it's part of the digest public API due to the trait impls on CtOutput. I guess that's where we need to start making calls on this (fortunately we can release cipher first).

Give me a day or so to see if I can get some clarity on what direction others want to go. Ideally I think we'd have one and only one constant-time library like that to deal with.