What sort of rate did you get for computing the hashed public keys?

I was not involved in that specific aspect, so I can't provide accurate information. We may release more information later in the future.

2^32 search space for each set? That seems to imply a little under 2,000 keys per second?

My numbers are very rough estimates and not good enough to do work on. More accurate information may be made public later.

I would be interested to see performance stats - I would expect an optimized attack (batch point inversion, large precomputed table to speed up multiplication, not bothering to try to be constant time) to run well over an order of magnitude faster than that.

Not that it's particularly worth bothering if you have an 80 core machine and only 13 billion keys to check.

And indeed, we did have an 80 core machine. <1 day after some code optimization passes.