[lowdanie]

Thanks!

I completely agree that it is possible to homomorphically evaluate b - <a,s> much more easily using homomorphic addition and multiplication. However, wouldn't we still need some sort of blind rotate magic to bound the output error?