> takes each shot's (j, k, r) and accepts d_cand = (r − j)·k⁻¹ mod n iff it passes the classical verifier

Judging by the fact the original code does more classical work than the prg solution, and in more practical terms, the fact it makes network calls, I'd say the quantum-integrated code is a lot slower for this set of problems.

src: https://github.com/GiancarloLelli/quantum/blob/7925f6ec5b57f...

> The author's own CLI recovers every reported private key at statistically indistinguishable rates from the IBM hardware runs.