Pegging out of Shielded Bitcoin requires proving that a corresponding denomination of shielded notes has been added to the nullifier set