Verifiably-Extractable OWFs and Their Applications to Subversion Zero-Knowledge