Basically we could have 1 transaction per block but involving more entities to forge a transaction will make it more prone to people never signing it. Also the 1 transaction per block would lead to having the true transaction data being public but outside of the blockchain. Similarly some "agency" could heavily advertise to merge transactions with its transactions just to be able to gather intelligence for later taint analysis. Therefore the best strategy for now would be to seek signing partners only in very small groups of maybe not more than 2.
It's quite possible to have a cryptographic protocol which can safely and completely anonymously combine between parties.
Warning: Very complicated cryptographic protocol below.
(fortunately this stuff just gets put in software and a user clicks the button)To participate in this system you must first have a fidelity bond:
You construct a
specially formed transaction that gives away some coins as fees in a way that proves you didn't receive them. A key committed to as part of doing this is your fidelity bond key.
People interested in forming an anonymous joint transaction join some broadcast communication channel (e.g. IRC over tor).
Every message they send is signed with their fidelity bond key.
They each put up coins they'd like to include and come to an agreement about the transaction. They each form a message about what output address they'd like to send the funds to, and
blind it, and send it to the group. They each advertise a key for blind signing.
The group then performs a group blind signature for each of the blinded messages.
The users unblind their messages, and advertise keys for a
reencryption mix. A first user generates some padding messages and their real unblinded token, permutes and encrypts them all, and advertises the result (In reality, he may need to do this many times, for a zero knowledge proof that he isn't screwing it up). Then a next user takes the result, adds their own blinded message, permutes the set, and reencrypts it all, and so on.
After cycling through all users several times, they decrypt, and the result is a randomly ordered set of output address messages which have all been signed by the whole group, but they cannot tell which users authored which. A transaction is created conforming to the agreed inputs and outputs, and all users sign.
If any any point a user refuses to sign in order to jam the process their misbehavior can be proven to anyone who cares to know by showing them the signed messages from a failed round. After seeing a proof they blacklist the misbehaving fidelity bond key, and so DOS attacking this can be made expensive.
I've omitted a lot of complex details (secure group random number agreement for consensus, constructing the ZKPs to show that someone isn't jamming the mix, etc) and waved my hands at things (like group blind signatures)... but its clear to me that it's certainly possible to construct such a thing. The engineering would be quite hard, as this kind of very lock-stepy everything proven algorithm is quite fragile compared to even Bitcoin. So, I don't expected it any time soon— but I'm happy to know that it's possible if it ever actually is needed. In reality, I expect few are going to try to gum up this sort of thing, so in practice people could get away with much simpler protocols.
