Seems correct at first glance. Would prefer init-to-zero over init-to-0xFF but that's nit picking.

Automatic sanity-testing: PASSED, see http://jenkins.bluematt.me/pull-tester/b6d07ce7ea07b1b79e96c25d7964f628fc3dbd4e for binaries and test log.
This test script verifies pulls every time they are updated. It, however, dies sometimes and fails to test properly. If you are waiting on a test, please check timestamps to verify that the test.log is moving at http://jenkins.bluematt.me/pull-tester/current/
Contact BlueMatt on freenode if something looks broken.

@jgarzik 0x00 is a valid serialized EC point (though not a valid ECDSA public key), so I prefer using a certainly-invalid data there, to trigger more errors in case of some out-of-bounds access.

Fair enough. ACK.

Automatic sanity-testing: PASSED, see http://jenkins.bluematt.me/pull-tester/b7b49b89d1f5b510c6269bb3d516a5300a53087f for binaries and test log.
This test script verifies pulls every time they are updated. It, however, dies sometimes and fails to test properly. If you are waiting on a test, please check timestamps to verify that the test.log is moving at http://jenkins.bluematt.me/pull-tester/current/
Contact BlueMatt on freenode if something looks broken.

Automatic sanity-testing: PASSED, see http://jenkins.bluematt.me/pull-tester/fd6e0a58f1b1b4b2ada60ba197ee541f5f0885d4 for binaries and test log.
This test script verifies pulls every time they are updated. It, however, dies sometimes and fails to test properly. If you are waiting on a test, please check timestamps to verify that the test.log is moving at http://jenkins.bluematt.me/pull-tester/current/
Contact BlueMatt on freenode if something looks broken.

Rebased.

Wanted to get this one in sooner rather than later, so that other work may be based on top of it (it stirs a lot of code)