The WhirProof struct is a bad pattern, as it breaks the nimue model that the transcript is the proof. Originally, it was needed because nimue did not support variable length messages (such as Merkle paths).
As a first step, we should remove the evaluate_at_extension points (as their number is known at protocol definition and can be added to the transcript).
Secondly, we should figure out how to remove this struct entirely.