aba@atlas.ex.ac.uk writes:
Technologically it would be possible to have multiple ombudsmen, or even have the recovery key be secret share split amongst ecash users in such a way that some chosen percentage of agreement would be required before cash could be traced, or revoked (made worthless).
I don't rember if any key-splitting schemes currently allow it, but how about this: the escrow agencies would be the courts, requiring one assent from each judge on the appeals chain. As each judge rules against the defendant or denies the appeal, he adds his piece of the key to the ruling. When you reach the top of the chain, then *and only then* can you be traced. I'm not really sure if this would apply in the ecash situation, since you don't have a defendant until you've done the trace, but it sounds like a legitimate safest solution in the case of GAK. One can hardly argue that the government has illegally revealed the keys when the whole legal system has approved it. NB: I'm *strongly* opposed to GAK in principle. I don't personally think there's any such thing as a "legitimate need for law enforcment" to listen in on private individuals. A free man shouldn't have to arrange for his life to be convenient for his servants --- private or civil, it should be the other way around. I'm just nothing that, working from the common notion of "legal", this system would make illegal key seizure unlikely.