PCS::check was zipping the commitments, proofs and claimed values. The issue is that zip is happy to combine two vectors of unequal length, in which case it drops off the excess elements from the longer vector. This could be dangerous, since check fails iff any of the individual proof checks fails, but those checks could be missed.

We considered using zip_eq, which panics if the iterators have different length. In the end, we opted for checking the lengths by hand so that we could control the error and return it. Unfortunately, this results in less-than-ideal syntax (but still acceptable), since one can't count an iterator and then iterate over it.

@autquis this is likely also relevant to the Brakedown and Ligero PRs. Let's keep it in mind, even if it's not an urgent fix :)