Proof of Unlearning: Definitions and Instantiation