Proof of correct construction of a private key in distributed cryptography
Here's what can happen if you don't do this verification:

Suppose Alice, Bob and company generate their public key shares honestly, $h_2, h_3, ..., h_n$

Now, Snidely Whiplash (who is also a trustee) is the last to contribute his share, he selects a private key $x_{evil}$ and computes $h_{evil} = g^{x_{evil}}$.  However, instead of sharing $h_{evil}$ as his share, he computes $h_1 = h_{evil} \cdot ( h_2 \cdot h_3 \cdot ... \cdot h_n)^{-1}$, and provides $h_1$ as his share.

Then, when we compute the public key, we get $h = h_{evil} \cdot ( h_2 \cdot h_3 \cdot ... \cdot h_n)^{-1} \cdot h_2 \cdot h_3 \cdot ... \cdot h_n = h_{evil}$

Hence, Snidely is able to decrypt any message encrypted with this public key, without the help from anyone else.

Asking Snidely (and everyone else) to prove that they know the discrete log of their share prevents this, because Snidely does not know the value of $log_g h_1$