Lower bounds for witness-finding algorithms