I have a question. If zcash will continue to release using the "trusted set up" then there is a high chance that it will be bashed by the known people of crypto. So I ask, what do you think is the better option for the zcash development team? How can they eliminate the trusted set up? Do they have to start from scratch?
You should take my answer with a grain of salt, because I haven't totally understood yet the trusted setup system. What I understand of it, grossly, is this:
you need a "private key" (a random number) X that will be the generator of two different but related public keys, p and q, that both serve to produce zero-knowledge proofs. One is the "proving key" and the other is the "verifying key". There is a kind of one-way function from X to p and q, so from X you can find p and q, but from p and q (which are public) you cannot trace back to X. So essentially, if you want to construct a proof that you own an unspent coin in a given list, you use p, and anyone can use q to verify that that is the case, without knowing WHICH coin you own in the list. You cannot construct a second proof using the same p and the same coin. However, the point is that with the knowledge of X, you can construct a fake proof that will be still verified by q. So you can "prove" as many times as you want that you owned a coin, and hence, you can create as many proofs of transactions as you want (which will be valid further on and hence are "new coins").
This comes down to saying that he who knows X, can create as many coins as he wants, and nobody is ever going to find out.
Now, visibly, they have a method to have several independent generations of X1 making pp1, X2 making pp2 and so on, and one can then combine pp1, pp2, .... pp18 into a final couple (p,q) whose corresponding X can only be deduced if you know at the same time X1, X2, ...X18. It is sufficient that one of these X is missing, and the final X is un-knowable, which is the goal.
I don't know how much this can be up-scaled from 18 to a much higher number, but I would propose the following:
On a bulletin board like bitcointalk, one could have a thread where up to a large N (say, 1000) people post their own calculation of ppi.
Once this number of contributions is reached, one calculates publicly the final p and q.
This is a bigger set of people than the 18 celebrities one would have to trust, and you can be part of it. There will (hopefully) be many known accounts posting their version.
Now, in order for this to fail, ALL those people posting (you included, if you posted) have to collude. As long as your contribution is in there (and this YOU know of course), you can trust the trusted set-up because you did this yourself, and you know that you aren't colluding (or if you are, you will profit from it too
).
In fact, if N is very large, there is no point in excluding one's contribution. If your contribution is excluded, you know there's something fishy. If one doesn't reach, on a given date, the number N, but only K, there's no problem in COMPLETING the list with N - K extra generations of pp. These may be all from the same person, that's no problem. As long as there is, within the list K (of which *you can be member*) ONE SINGLE person keeping/erasing his Xk, the system is OK.
The big difference with "18 celebrities" is that ANYONE can be part of the trusted set-up. You included. So, or you aren't interested in which case it doesn't matter, or you are interested, in which case you can be part of it (and if you find out that it fails, you know that ZCASH is unreliable).
Of course, that doesn't change anything for newcomers afterwards, but 1000 or more people on a forum are maybe more prone to contain one honest person rather than 18 celebrities.