I tracked it down and the bug was on my end, not AEGIS. Our NIP-46 sign_event requests were sending event JSON without pubkey. AEGIS was right to reject that shape. After I restored pubkey in the remote sign_event payloads, QR login worked. Sorry for the noise, and thank you for taking a look!