Avoid unexpected infinity when aggregating pub keys

[nulltea]

Issue

If a bad r is sampled and used to initiate an accumulator, then the resulting agg_pubkey - r could be the point at infinity, which would likely result in the signature validation failing. However, this is a very unlikely scenario.

Fix

Aggregate from PK[0] instead of random point. Though since participation[0] could false we need to set

let acc = CMOV(PK[0], G1::Idenity, participation[0])`

Question

Is it safe to use identity? The halo2lib API actually prohibits implicitly assigning identity as constant, though allows it as a witness.

[ec2]

That's actually something I thought about and forgot to ask... Why was it originally a random point? I've seen this done in halo2-lib as well for other stuff.