Fixpoint elements' (x: tree) (base: list key) : list key :=
  match x with
  | EE => base
  | T _ t1 k t2 => elements' t1 (cons k (elements' t2 base))
 end.

Lemma diff'_spec : forall s s' x, valid s -> valid s' -> (interp (diff' s s') x <-> interp s x /\ ~ interp s' x).