We currently use the Go implementation of secp256k1 by btcsuite: https://github.com/btcsuite/btcd/tree/master/btcec. It is not constant time, and hasn't received nearly as much scrutiny as libsecp256k1, used by Bitcoin and Ethereum.

So while we want to continue to have a native Go version, we should also building with the libsecp256k1 C library, and recommend that for production.

Related #3162