Avoid encuraging usage as VRF

[burdges]

This might be beyond the scope of the standard, but VRF use cases do not benefit from BLS so often, especially because VRFs cannot be aggregated, only batch verified. An exception here is verifiable secret sharing (VSS) of course. VRFs based on Schnorr DLEQ proofs should be faster in most applications, basically all applications except VSS, PVSS, etc. See NSEC5, VEd25519, or https://github.com/w3f/schnorrkel/blob/master/src/vrf.rs