Comment by juitpykyk

Some tools scan for crypto algorithms, typically by searching for the magic numbers, Ed448 is so new many tools probably don't recognize it.

Malware authors frequently change the crypto magic numbers to prevent detection.