Comment by jgunsch

The linked Twitter thread mentions that BoringSSL (maintained by Google, used in Chromium) has an implementation already.