Expected length of signature depends on its group order, not field order

umbral/signing.py

@@ -50,7 +50,7 @@ class Signature:
     @classmethod
     def expected_bytes_length(cls, curve: Optional[Curve] = None) -> int:
         curve = curve if curve is not None else default_curve()
-        return 2 * curve.field_order_size_in_bytes
+        return 2 * curve.group_order_size_in_bytes
 
     def verify(self, message: bytes, verifying_key: UmbralPublicKey) -> bool:
         """