sarang: It turns out I greatly underestimated the performance benefit of using Gray coded indices over the anonymity set in each proof. I realize now, that in batch verification over mid~large sets, the number of scalar multiplications grows linearly with the number of proofs in the batch, while the number of point multiplications grows relatively slowly. For large batches, scalar arithmetic actually dominates verification time.

To put concrete numbers to this, I built a test case on a bare one-out-of-many proof setup, showing a 60% performance improvement when using Gray coded indices vs normal binary sequence. (Batch verify 100 proofs with anonymity set size = 4096):
https://github.com/cargodog/one-of-many-proofs/issues/19#issuecomment-695730119