great writeup on breaking the soundness of non-interactive protocols that use fiat shamir without committing to the entire protocol's transcript. see my tl;dr in the screenshot