VerifyDerived(zkey', message, signature):
  (R,S) := signature
  return S * G == R + SHA-512(R, zkey', message) * zkey'