Perhaps the process should be reversed. Random selection from the pool of all candidates, followed by a 'proof of fitness' check that is conducted in secret in

Perhaps the process should be reversed. Random selection from the pool of all candidates, followed by a 'proof of fitness' check that is conducted in secret in such a way that the identity is not as easily subjected to being leaked. This would eliminate the list, but as to how to best perform the second step, I'm not entirely sure.