One of the steps of the creating and checking the Ciphertext authentication tag is to compute a G2 hash element as follows (in pseudocode):

   tag = hash_to_G2(commitment_U, sym_ciphertext, aad)

However, this forces that anyone performing ciphertext validation (e.g. Ursula) must pass the symmetric ciphertext, which can be very inefficient. Instead, let's just pass a hash of the ciphertext:

   tag = hash_to_G2(commitment_U, sym_ciphertext_hash, aad)

With this change, the consumer would never have to include the bulk of the symmetric ciphertext in the decryption request, but only it's hash, which even has a known size.