Instead of having a separate protocol for verifying correctness ("the challenge protocol") we can simply integrate it as part of the re-encryption request and reply.

Basically, the idea is to include the challenge request as part of/together with the Capsule, and put the challenge response as part of the cfrag. The disadvantage of that is that we are adding a communications overhead for all re-encryption requests (i.e., metadata such as timestamp to avoid replays) and re-encryption responses (i.e., around 5 or 6 points/bignums). The advantage is that we get rid of supporting an additional protocol, and on top of that, we always get correctness guarantees on each re-encryption.