obeliskgolem

Just noticed that in the verifier program, there are no checks against the commited points.

especially the pairing that checks P == H*Z:

```
let d = E::pairing(
        (pk + proof.pi_input) + (pk + proof.pi_input) + proof.pi_output.mul(-E::Fr::one()).into(),
        E::G2Affine::prime_subgroup_generator(),
    ) == E::pairing(proof.pi_H, setup.rho_Z);
```