I need some guidance on elliptic curves that support signing and key agreement.
I am trying to develop a protocol for sending encrypted, deniably authenticated messages. To do this I will sign the message with a 2-key ring signature using the sender's signing key and the recipient's encryption key.
Is there a sensible elliptic curve to use for this? Ideally it would meet the safe curves standards and provide the same level of security as Curve25519 (i.e. 256 bit length / 128 bit security).
Ed448-Goldilocks looks like it fits the bill as a curve intended to support both functions but is there anything more lightweight?