Thanks for your thoughts everyone.

I probably should have done a bit more reading and led with the MPC solution, which doesn't leak your private data to the authority at all. If used over Tor (ouch, slow!) it fully addresses the concerns about unmixing being voluntary.

Basically multi-party computation (MPC) is a magic box for lots of people combining their secret data and calculating some aggregate values, without anyone knowing anyone else's data. The aggregate values can be shown only to certain people.

The theory says that there's an MPC algorithm for every problem in NP, the only question is how fast it is (these algorithms can be prohibitively slow). There's a ton of research being done here, and it's getting faster every day. The paper Mike referenced had working code for doing private set intersection on an Android phone in a reasonable amount of time, and I also found a later paper claiming to have beaten that performance using a custom PSI protocol.

I think this problem needs MPC signature verification as well as set intersection - you want every (input, output) pair to be doubly signed, otherwise malicious colluding adversaries can wholly implicate non-participating parties.

On quotas, I was imagining quotas would be an incentive for greater transparency; people have bigger quotas for more transparent/democratic organizations.

Payment/reward for financial history is really interesting. There might be some gaming attacks to be done for profit. I wonder if a contract could be devised such that if someone pays the asking price for some output in a tx, they'd be guaranteed to get back a signed input in the same tx.