@hoeteck suggests in the below-quoted comment that we get rid of a layer of indirection in S2-S3.
See linked discussion for my initial thoughts.
I'm leaning towards not defining the {signature, pubkey}_subgroup_check routines because they create an additional level of indirection. Rather, just define subgroup_check that takes a point (which also determines E1 / E2) and checks whether it lies in the subgroup. That said, I understand we may want to specify E1/E2 more explicitly.
@hoeteck suggests in the below-quoted comment that we get rid of a layer of indirection in S2-S3.
See linked discussion for my initial thoughts.
Originally posted by @hoeteck in https://github.com/cfrg/draft-irtf-cfrg-bls-signature/pull/1