Also, AFAICT (haven't really got into this properly), this project uses SpartanNIZK specifically, and that does *not* have sublinear verification time (it has a cost component linear in the size of the R1CS, specifically), which is probably the single most crucial property if you want, as I do, to be able to publish "I own one of a huge number of keys" proofs. Groth16 has constant (very fast) verification time irrespective of circuit complexity, which means for some applications, the trusted setup is probably the better choice.