An experimental Rust implementation of Schnorr signatures based on the Ristretto prime order group, built on curve25519-dalek and a fork of ed25519-dalek, primarily for my own learning / interest.
It's insecure and not meant to be used. Don't use this unless you are just learning / experimenting. DAVROS is the repository to watch for a real use implementation of Schnorr signatures based on Ristretto.
Also, thanks to the dalek-cryptography folks. Their code is super readable and well documented.
Are you considering implementing something on this? Really, don't. Follow the development of DAVROS.
Why not ed25519? Why ristretto?
ed25519 signatures are "malleable" because the scheme is constructed over a non-prime order group. This can create vulnerabilities in some crypto protocols. Ristretto is a prime order group constructed over the Edwards 25519 curve.
Implementing Schnorr signature schemes in the Ristretto group also allows one to preserve mathematical properties that are lost in the ed25519 scheme. This allows one to implement more complex protocols on top, e.g. hierarchical key derivation.