@SuppressWarnings("NarrowingCompoundAssignment")
  public static byte[] generatePrivateKey() {
    byte[] privateKey = Random.randBytes(Field25519.FIELD_LEN);

    privateKey[0] |= 7;
    privateKey[31] &= 63;
    privateKey[31] |= 128;

    return privateKey;
  }
Returns a 32-byte private key for Curve25519.

<p>Note from BoringSSL: All X25519 implementations should decode scalars correctly (see
https://tools.ietf.org/html/rfc7748#section-5). However, if an implementation doesn't then it
might interoperate with random keys a fraction of the time because they'll, randomly, happen to
be correctly formed.

<p>Thus we do the opposite of the masking here to make sure that our private keys are never
correctly masked and so, hopefully, any incorrect implementations are deterministically broken.

<p>This does not affect security because, although we're throwing away entropy, a valid
implementation of computeSharedSecret should throw away the exact same bits anyway.
java_src/src/main/java/com/google/crypto/tink/subtle/X25519.java