Review of protocol spec

[ebfull]

1. In 2.2, Nathan's note could mention that output arity also affects the design there, due to PRF^ρ.
2. In 2.4.1, the text "Any ciphertext components that fail to decrypt with a given recipient's private key will be ignored" needs to be clarified with who, what and why.
3. In 2.4.2, "InternalH" needs a better name. I originally called it this probably as a placeholder. Does the zerocash paper not have a name for it?
4. In 2.7 our description of anchors can be simplified. "A pour description's anchor may reference an earlier block's treestate or the treestate of an earlier pour description." We could also clarify "The treestates of pour descriptions are their anchored trees appended with their commitments" or something, so people know what we mean by their treestates.
5. In 4.5 the text regarding s should be in magenta, and we should also be clear that we differ from zerocash in this respect because we can: a naked commitment is perfectly fine there.

Feel free to close this once you've considered or fixed everything in this ticket.

[daira]

+1 for comments 1-4.

Re: 5, the text about s also applies to the protocol in the paper; it is not a change.

[daira]

All considered or fixed.