I did further testing on this, especially checking manually what is going on in the third (and failing) exchange of oauth_verifier to access token and secret. The first few error messages from the API are rather clear:

That is the correct consumer.