How does `d-KCA` help secure the zcash protocol? I have been going back and forth between part 2 and part 4 of the Explaining SNARKs series.


In part 2, it is claimed that Bob has an idea about the polynomial and want to test whether Alice knows it by sending her $(g, s.g, ..., s^d.g)$ and checking the answer $P(s).g$.
In part 4, it is claimed that now Alice return 2 polynomials $a' = P(s).g$  and $b'=\alpha P(s).g$ computed from $(g, s.g, ..., s^d.g)$ and $(\alpha.g,\alpha s.g, ..., \alpha s^d.g)$. But now Bob only check that $b'=\alpha.a'$ and that if it is the case then Alice knows with high probability $(c_0,...,c_d)$.


My question:
What is the use of the d-KCA knowing that:


If Bob knows $P$ and the probability that Alice answers correctly without using P is very low, then the verifiability is ensured already.
If in the d-KCA, Alice sends back $a'=\beta .g$ and $b'=\beta \alpha .g$, we have $b'=\alpha . a'$. So if Bob only check that equality he can be fooled.


I am really wondering what I am missing...
Two points:


Bob does not know $P$ which is partly the point of the protocol.
Alice could respond with the $\alpha$-pair $(a',b') = (\beta g, \alpha\beta g)$, there is nothing wrong with that. This implies that her coefficients are $c_0=\beta, c_i=0$ for $i&gt;1$.


However, this will only do her any good if her coefficients $(c_0, \cdots, c_d)$ actually present a solution to the QAP.