Well, then I missed something, exactly for the attack I previously mentioned, and your answer.
....
I think you are missing that both hashes that represent the private transaction are already enclosed into a regular public transaction that is signed as usual:
private_transaction: {
regular_public_inputs: [...],
regular_public_outputs: [...],
hash_of_private_payload: ".....",
spend_proof: "....", signature_of_all_the_above: "...."
}
The bolded part is what makes a private transaction different from a regular one. It is covered by the signature and we know who signed it.
You can't redeem BBC back to bitcoin. "Unburning" would mean dumping the entire history of the coin to the public, which is clearly against its purpose. But you can exchange it.
The thing is, one could think of a cryptographic way to redeem the bitcoin, instead of burning it, style Lightning network, so that in the end, only one transaction needs to be broadcast, to the final owner. I don't know exactly how to do this, but it must be possible in some way.
Still seems unlikely that it is possible, but if you find a way, I'll be glad to know.