This is a technical question for Gregory or the other authors.  When the verifier (i.e. buyer) produces the public parameters for the SNARK (or any NIZK for that matter), the protocol may no longer be zero-knowledge.<p>The protocol is ZK because there exists a simulator which can produce an indistinguishable setup, and simulate proofs. This does not mean that if you allow any V* to produce a CRS, the simulator can still simulate.<p>I cannot think of an explicit attack off-hand, but wonder how you deal with this.