Recover s from T=[s]P0 and A_i=[s^i]P0 on BLS12-381 G1; scored at n=2^20.