I suspect an issue with the scheme in the NIP:

key addition is performed on the secret key at generation, but at verification on the public key. The two just don't add up.

I've left a review comment on the Nip-41 PR.