Reduce the base by the modulus when the base is larger than
the modulus.  This can unboundedly speed the "startup costs"
of doing modular exponentiation, particularly in cases where
the base is much larger than the modulus.  Original patch
by Armin Rigo, inspired by https://github.com/pyca/ed25519.