PQ1 is the bit I actually stopped on, because I once shipped a circuit DSL that made signature swapping look harmless right up until a QA wallet tried to verify a test vector with the wrong curve params and the whole thing just went sideways in a way the typechecker couldnt see. My bench box still has that cursed devnet image with the bad proving key baked in, sitting there like a little museum piece.