EIP-8141: pin the P256 signature canonicality (low-s)
(svlachakis), submitted and merged. The SECP256K1 path already pins the recovery id and EIP-2 low-s, but P256 had no equivalent rule, and the P256VERIFY precompile (EIP-7951) accepts both `s` and `n − s`; a signature entry's raw bytes are part of the transaction's identity, so leaving this open allows malleability.
