Digicash tagged with payee?

[Hal <hfinney@shell.portal.com>]

I have heard it claimed that when you make a payment with Digicash ecash,
the identity of the payee is encoded or embedded into the cash somehow.
This is an anti-theft measure (among other things, perhaps).  The bank
checks that the embedded identity in deposited cash matches the account
name which is doing the deposit.

My question is, how could this be done?  How can the payor, at payment
time, without communicating with the bank, embed a payee name
irreversibly into the cash so that a thief cannot strip it out and
replace it with his own name?

Is it perhaps a matter of encrypting the cash with the public key of
the payee?  If so, how does the payor get that?  Is it provided by the
payee during the TCP connection?  Is it authenticated with a
certificate, perhaps signed by some Digicash root key?

Off-list there has been some discussion about the role of certificates in
ecash, and in cash systems in general.  It would be interesting to know
if this anti-theft provision of Digicash is actually provided by means of
a certificate.