One incomplete answer: At the bottom, this lets you prove that you know a signature without revealing what that signature is. This idea has been used in anonym

One incomplete answer: At the bottom, this lets you prove that you know a signature without revealing what that signature is. This idea has been used in anonymous credential systems---much like this one! In the cryptographic literature, the underlying idea goes back to David Chaum ("Blind signatures for untraceable payment," Crypto 1982) and as far as I know the first implementation was Camenisch and Lysyanskya ("An efficient system for non-transferable anonymous credentials with optional anonymity revocation", Eurocrypt 2001). Even without the zero-knowledge property this idea is useful, essentially because the "K" in "SNARK" stands for "knowledge" (as in, argument of knowledge). In other words: a convincing proof tells the verifier that the prover must know a signature, even if the prover doesn't actually publish that signature. You could also prove that you know 10 signatures, or 100, or more (well, up to the somewhat limited reach of existing proof systems). Meanwhile, the size of the proof and the cost to verify it grows much more slowly than the number of signatures whose knowledge it establishes---so you can think of this as a kind of cryptographic "compression." This is one of the big ideas behind rollups, which are one possible way of improving the scaling behavior of blockchains like Ethereum.