Yeah, @Natalia linked in her comment to this explanation by calle on nostr.
On privacy: this hurts privacy for peg-ins and peg-outs for example. Even if there was full KYC, ecash is still a lot more private than a normal custodian. The provider doesn't have a view into your wallet, can't take your ecash, and can't stop you from transacting with others.
So it sounds like you are correct.
I keep noticing these half-truths, such as: "...and can't stop you from transacting with others."
A mint can't stop you from transacting with others WITHIN THE SAME MINT.
cashu tokens are only valid on the mint they are minted on. If I take a cashu token from mint A and try to use it on mint B, such as sending it to another user, that token will not work. Some kind of on/off ramp, such as Lightning, is required to transact across mints. Those ramps are the chokepoint.
This can work out in a different way too. User A invites use B to a KYC mint in order to pay for goods/services. User B accepts the invitation to add the mint (to get paid) only to discover that a KYC process is required. User B is from a sanctioned country, so... that's not gonna happen. User B goes home empty-handed.
reply