Fix how challenge value is sampled

[alxdavids]

• This must change in the draft also
• Previously the challenge value was sampled from SHA-512
• This isn't big enough for P-521
• We now use HKDF-Expand to sample the challenge
• Also added expected values for test vectors