Breaks an isogeny VRF two ways, first by representation ambiguity, then by recovering the 256-bit secret key with 1536 queries.