Does it need to be a separate function?    This potentially sets as up for another situation similar to the consttime flag, where we/contributors might forget to use the randomized version instead of the normal version.    Wouldn't it be preferable to unconditionally use the version resistant to Nonce@Once proposed here and the previous PRs? I doubt there are spots where we are using `BN_consttime_swap()` where we do not want to be protected from attacks like the Nonce@Once one.