certificate binding a public key to it, without ever learning the identity, which sounds perfect for the required scenario except that it requires 3 parties and it’s impossible to achieve in the 2-party setting; moreover, it doesn’t consider Sybil-resistance.

Other approaches to anonymous identity include: Lightweight Anonymous Subscription with Efficient Revocation[@cryptoeprint:2018:290], although it doesn’t consider the real-world identity of users because it’s focused on the host and its Trusted Platform Module; One Time Anonymous Certificates[@onetimeanonymouscertificate] extends the X.509 standard to support anonymity through group signatures and anonymous credentials, although it doesn’t consider Sybil-resistance and their group signatures require that users hold two group secret keys, a requisite that is not allowed in the current scenario because the user is not trusted to store them on the national identity card (for the very same reasons, Linkable Ring Signatures[@cryptoeprint:2004:027] and Linkable Message Tagging[@cryptoeprint:2014:014] are not allowed as cryptographic tools whilst group signatures and Deniable Anonymous Group Authentication[@daga] would require a non-allowed setup phase). Opaak[@opaak] provides anonymous identities with Sybil-resistance based on the scarcity of mobile phone numbers: however, users must register by receiving an SMS message (i.e., the Anonymous Identity Provider knows the real identity of participants). Oblivious PRFs[@cryptoeprint:2018:733] are not useful 