See bug 1353216, wherein we discovered that the EC signature verifications Firefox was doing as part of gathering certificate transparency telemetry noticeably slowed down the TLS handshake. Long story short is that EC signature verifications are slower than it seems like they should be. I'm attaching a short program that generates a key (ec or rsa), signs a hash, and then repeatedly verifies the signature to demonstrate the difference: keeler@p710 ~/scratch/signatures $ time ./signatures --ec generated key pair... signed hash... verified signature(s) real 0m5.122s user 0m5.113s sys 0m0.002s keeler@p710 ~/scratch/signatures $ time ./signatures --rsa generated key pair... signed hash... verified signature(s) real 0m1.743s user 0m1.740s sys 0m0.000s

Well, I'm not surprised that ECDSA is slower than RSA verification. That's probably something we can't change. But it should be faster nonetheless. Given that P256 is already the fastest curve (for DSA) we have we have to do something here. I'll try to make a plan.