Accumulator for context hash
The context hash could be replaced by two accumulators in the following way:
Treat the context as a key-value store. Consider a cryptographic accumulators m (representing a group elements in an RSA or classgroup accumulator)
When inserting (k,v) for the 1st time, do
m <- (m^H(k,v))^H(k)
When replacing (k,v_old) with (k,v_new)
m <- (m^H(k,v_old,"deleted"))^H(k,v_new)
H is a hash function mapping to primes.
In order to prove that value v is associated with key k, a prover would either show that the key was never inserted in the first place (H(k) not present) or show that H(k,v) is present and H(k,v,"deleted") is not.
This has the benefit of never requiring expensive deletions from the accumulator, so a node can keep the accumulators up to date without too much computation.
For efficient proof generation, node intending to serve light clients can keep an accumulator of all "deleted" entries, along with a Patricia trie of all non deleted entries, with each node containing the accumulator for the corresponding subtree.