Reduce the base by the modulus when the base is larger than
the modulus.  This can unboundedly speed the "startup costs"
of doing modular exponentiation, particularly in cases where
the base is much larger than the modulus.  Original patch
by Armin Rigo, inspired by https://github.com/pyca/ed25519.
(grafted from f34c59494420765b013136ca93f63b716d9f1d30)