I was hoping that sharing https://briansmith.org/ecc-inversion-addition-chains-01 would result in shorter addition chains being shared. I’m only aware of two cases where a shorter chain was shared: someone shared one for P-256 scalar inversion and then I found one shorter than theirs (implemented in *ring* in 2024). That made me confident that shorter chains for all the scalar inversions should be relatively easy to find. Newer non-FLT algorithms & formal verification mainstreaming make the problem less interesting, but still…