Anonymous Mailing list?

Has anyone tried to write some mailing list software that uses
PGP-anon-remailers to implement a double-blind anon system?
 
It wouldn't be very dificult to have a mailing list people contributed
to using a remailer with a encryted address-block, so no one knew
the actual address of the mailing list. Or more significantly, the
mailing list, instead of keeping a list of addresses, could keep a list
of encrypted address-blocks, and the proper remailer to send them to, so
the list maintainer doesn't know the real address of anyone on the list.
 
This is intriguing to me because it seems to solve the problem of a 
"secret" organization's security. The members of this mailing list don't
need to trust anyone else on the list not to reveal their identity; no
one can reveal anyone elses identity even if they wanted to. Assuming
the security of the encryption (which of course can't be assumed; anyone
with a sufficiently powerful comptuer and sufficient time to spend can
surely break PGP, but anyway...), this mailing list would seem to be
pretty much 100% secure. 
 
It would also seem desirable to have the mailing list software keep a record
of all it's members public keys as well, and send out posts encrypted. 
As well as perhaps check signatures of incoming messages so that only
legitimate list-members could contribute to it. 
 
I've been thinking of trying to write such software, perhaps by working with
the procmail program from comp.sources.misc, whcih can be used to implement
a standard mailing list. But has this already been done? It seems like such
an obvious idea, that it's hard to believe no one has thought of it first,
but I haven't heard of anything so far. Comments?

I've look a little at using something similiar to Julf's double-blind 
system integrated with majordomo along with an encrypted database of 
addresses.

The user would send mail to listname@sitename, and then be matched to a 
pseudonym and it would be then sent out as pseudonym@sitename to the 
subscribers of the list.  Any mail back to pseudonym@sitename would be 
directed back to the real person and mail replied back to 
listname@sitename would be delivered as a pseudonymed name as well.

The database that matches the pseudonym to the real person would be 
encrypted to prevent prying eyes (although it does increase the overhead 
requred to decrypt the name).  I also looked at using a system that did 
not rely on human input for the keys or passphrases, using a 
machine-generated randomly garbled key phrase or some such.  An 
administrator could get physical access to the key, but without knowing 
the phrase they have a job ahead of them.

Unfortunately, lack of programming experience and time has forced me to 
push it way back on the agenda.

____        Robert A. Hayden       <=> hayden@vorlon.mankato.msus.edu
\  /__          -=-=-=-=-          <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info  <=> I do not necessarily speak for the
   \/   Finger for PGP Public Key  <=> City of Mankato or Blue Earth County
-=-=-=-=-=-=-=-
(GEEK CODE 1.0.1)  GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++
		       n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)