Auditable Tracing with Unconditional Anonymity