Please please please -- let's drop (at least for now) the "invalid nonce... hash is not"?
I do see them in regular use and I know that it happens only once a day or so, but fixing up later on is more "expensive" than just not catching some quite rare malicious attempts.

just other thought aloud: collecting so many failregex'es into one filter might also be quite aggressive to users' human-errors if a single unsuccessful attempt possibly resulting in few associated error  messages would get logged...  I haven't analyzed them for possible co-occurrence but I guess some could come together?