[ckwalsh]

Ah that makes sense. For sufficiently small values of N, a hardcoded allowlist isn't a problem.

You're probably right that RSA 4096 "just worked", and some library in their stack doesn't have elliptic curve support. And again, if N is small, the verification performance doesn't matter that much.

Nice find and writeup!