But I don't think the blinding scheme presented in section 3.2 can be trusted if the bank logs all coins it signs and all coins it verifies. When signing a coi

But I don't think the blinding scheme presented in section 3.2 can be trusted if the bank logs all coins it signs and all coins it verifies. When signing a coin to make a withdrawal, the bank is given (r^v · M (mod N)) - N and v is publicly known, M and r are only known to Alice. The bank computes r · M^s (mod N) (using s, which only the bank knows). Later, Bob supplies the bank with M', a message, and (r · M^s (mod N)) / r, and the bank is not supposed to be able to link M' back to M. But the bank can enumerate all (r_i^v · M_i (mod N)) that it signed, and divide by M'; if M=M', the result is of the form r_i^v (mod N). The bank knows the prime factorisation N = pq, so they can test r_i^v (mod p) and r_i^v (mod q); for a prime modulus, computing a power residue is efficient, and for a large enough p and q (as you want in cryptography) and a moderately high v, this gives a high level of confidence that M=M'.