Anonymity vs. traceability: revocable anonymity in remote electronic voting protocols