I can say that my co-developer refused to allow the masternodes have the ability to unmask the anonymity. I was arguing for a simpler design but his standards of ethics on the technology are even higher than mine. Then apparently we were able to devise a solution so the masternode could not unmask.