[betterunix2]

The verifier learns the NIZK itself; i.e. the verifier could not have computed the NIZK independently.