I'm working in a very constrained (in code size/memory) microcontroller environment where I'll need public key signature verification. The algorithm to be used can be chosen, and there's no performance constraint; signature verification is a rare event. The data to be verified is obtained by a one-way channel with untrusted intermediate parties so there is no option to substitute key exchange or similar in place of static signatures.
Curve25519 code is already present for ECDH use, as is BLAKE2s for hashing (needed elsewhere). My understanding is that it's not possible to share much code between Curve25519 ECDH and Ed25519 or ECDSA-with-Curve25519, but the bigger problem I'm facing is that (standard) ECDSA and EdDSA require SHA512 as their hash function, and SHA512 is utterly giant compared to the size of the system.
Is there any reason not to replace SHA512 with BLAKE2s (expanding it up to 512 bits in a suitable manner) for the hash? If it's okay but there's no standard way to do this, does it make sense to base it on Ed25519, or would it be better just to do ECDSA with Curve25519? (In other words, can the ECDSA form be done in a way that shares some or all of the code with the ECDH?)