The Meta-Certificate Group - MCG, an international non-profit open group, is connected by a shadow-id anonymized list-server, mcg-talk. It is based on majordomo, which was changed to have the following characteristics:

(i) all postings to the list are stripped clean of all source and routing information, retaining only the subject, date and body fields, with no attachments or MIME fields. The postings are anonymously identified with a shadow-id -- a "salted-version" of the one-way hash function of the sender's e-mail -- and then echoed to the participants.
(ii) any subscribed user can post and receive posts, unmoderated.
(iii) only e-mail from subscribed users are forwarded (anti-spam, etc.).
(iv) standard procedures are used to automatically subscribe and unsubscribe to the list, with moderated entry.

General information on subscription and on the mcg-talk list is available here.