The trust model — stated precisely

Onboarding eligibility proofs are verified off-chainby the quorum, which then co-signs. The registry stores the signed credential commitment and checks the quorum's signatures on-chain — it does notrun a SNARK verification at onboarding. On-chain pairing verification isn't cost-viable on Casper today, so Writ verifies off-chain and commits on-chain, and says so plainly.

The expensive on-chain Groth16 verification runs in exactly one place: the fraud challenge. Every eligibility decision is published as a proof anyone can verify. A false attestation can be challenged on-chain — the verifier re-checks the credential's own stored proof, and if it's invalid the quorum that signed it gets its bond slashed, the credential is revoked for fraud, and the remainder is burned. The expensive cryptography is paid only in a dispute, never on the happy path.