@VitalikButerin @colludingnode You need composition. And if careful, you can depend on trust for coercion resistance, but not anonymity. This kind of real-world protocol design is hard. Easier to push commodity ZK, or FHE, or TEEs. Indeed, people miss that building private protocols on top of zk is hard.