Whispers_in_the_Curve

We intercepted two encrypted transmissions from an unknown operative. Their communications use a custom elliptic curve signing scheme — probably rolled their own because they thought no one would recognise it. We managed to pull the curve parameters and both signed messages off the wire. The operative's public key is known. Their private key is not. Something about these signatures feels... off. Can you figure out what they did wrong, and recover their private key?

"The strength of a signature is only as good as the randomness behind it."