enhancement request: implement KDF (SDHI and/or Naor-Reingold)

By way of backround, this request is based on my reading about Meta Anonymous Credential Service which they recently open-sourced (unfortunately in C !) https://github.com/facebookresearch/acs.

Anyways ... TL;DR, the curious beast in me thought I might have a go at re-implementing it in Go so I can play around with it.

Obviously Go stdlib doesn't provide many of the necessary building crypto building blocks, but circl does:

• VOPRF :white_check_mark:
• DLEQ :white_check_mark:
• Ed25519 :white_check_mark:

But unfortunately .....

"attribute-based key derivation function" :x:

Meta say in their blog post:

We recommend Strong Diffie–Hellman Inversion (SDHI) or Naor-Reingold for better key transparency.

Hence this request :wink: ( espcially as my github searches seem to show nobody else has a Go implementation of either of those KDFs either)

Perhaps see also comments in the header files re: SDHI and Naor-Reingold: kdf/kdf_sdhi.h kdf/kdf_naor_reingold.h