I am trying to understand why it is a hard problem to have formally verified constant time arithmetic for DSA when compared with ECDSA. For instance, in ECDSA implementations of OpenSSL, we have specialized constant time ECC curve-specific implementation for NIST curves which are optimized per architecture. Similarly, EverCrypt and fiat-crypto have formally verified constant time arithmetic implementation specific to the curve.
This is particularly interesting in the case of applying nonce padding as a remote timing side-channel countermeasure for EC(DSA). While fixing the nonce bit length does fix timing attack vulnerability in the case of ECDSA, a curve-specific constant-time implementation if done properly does not actually require a nonce padding. In the case of DSA, I am trying to understand, why we cannot have group-specific arithmetic and only stuck with nonce padding as the solution. I can understand the fundamental difference that they operate on different groups, but why DSA groups are stuck with a generic implementation when compared to ECC groups?