I like that there isn't some multisig into which users deposit. As far as I understand PIPEs, it's just the user creating specialized keys that they provide to different people for different reasons.

Moving bitcoin into the shielded metaprotocol (peg-in) and back out to ordinary bitcoin (peg-out) is covered in the upcoming paper. The solution we explore there uses PIPEs, our work on using witness encryption to condition access to Bitcoin signing keys. We never hold users’ funds, including during entry and exit.

I'm still trying to sort out whether transfers within the Shielded Bitcoin system always require a bitcoin transaction (I think yes?) or whether they can be achieved just with key magic.

Notes are never visible on Bitcoin in readable form. When someone initiates a transaction, they publish an encrypted transfer to Bitcoin, along with a zero-knowledge proof that the transfer is valid. Bitcoin just stores and orders these bytes. It doesn't understand them, and it doesn't need to. Separate software reads the transfers in Bitcoin's order, checks the proofs, and keeps the shared list of notes. Think of Bitcoin as a public bulletin board: Bitcoin publishes and orders the data, while anyone can independently apply the Shielded Bitcoin rules to determine the resulting state.

They describe the difference between their protocol and Glass Coins like this:

The data needed to reconstruct the shared state is published to Bitcoin itself. Once the system has been initialized, a wallet can reconstruct its later state from its own secrets and Bitcoin history, rather than depending on private proof data that a user or counterparty might lose.

The meta data is published in op-returns.

The current implementation profile specifies a single OP_RETURN output as the carrier for the complete transfer envelope.

They have this diagram, but I didn't find it too helpful.

Haven't had time to read this yet. What did it say about shielded TX fees?