Commit to k(Y) prior to sampling y

[ebfull]

k(Y) needs to be placed in the transcript prior to the choice of y or there will be soundness problems (prover could maliciously fiddle with the public inputs to satisfy the checks later.) This should have no real impact on performance, I was just too lazy to implement it at the time.