Traceable Digicash?

[Hal <hfinney@shell.portal.com>]

The Magic Money digital cash system, which is based on one of the earliest
papers on electronic cash, is traceable.  That is, the payer can collude
with the bank and together they can recognize when the payed-out cash is
turned in.  In some situations, this could be beneficial.  If people have
bank accounts in their True Names, or are otherwise physically traceable
when they turn in money, then if someone steals cash or otherwise uses
coercion to acquire it, then they will not be able to turn it in without
being caught.

Virtually all of the digital cash proposals that I am aware of have this
property.  They protect the payer's privacy very strongly, but they don't
offer much protection to the payee.  Technically it is difficult to protect
the payee because the cash would have to be changed while in his hands so
that it is not recognizable to either the bank or the payer.  This would
require two re-blinding operations, one by the payer and one by the payee,
and it is hard to have a system which could do this and still detect double-
spending.

People might want to think about the pros and cons of traceable cash.  It
could limit some possible applications.  On the other hand, it may be good
to help prevent coercion.  One of the cash papers (I can't remember which
one) mentioned this as an explicit advantage of the cash that was proposed.
Does anyone know of any cash systems which protect the payee's privacy?

Hal