Ah that makes sense. For sufficiently small values of N, a hardcoded allowlist isn't a problem. You're probably right that RSA 4096 "just worked", and some lib

Ah that makes sense. For sufficiently small values of N, a hardcoded allowlist isn't a problem. You're probably right that RSA 4096 "just worked", and some library in their stack doesn't have elliptic curve support. And again, if N is small, the verification performance doesn't matter that much. Nice find and writeup!