How can I allow user actions without knowing that the actions are theirs?

Is it possible to create a system where I get to choose who is supposed to use a specific service, but when they do something I won't know that it's them?

Think of a system where users have names they can use to append to a collaborative text file. If I handed them passwords, they would be able to use their name and their password to access the system, but at the same time when they append a string I should at no point be able to link their name to that text.

I planned on using message signing to allow users to generate their own private and public keys, then sign their messages and send the signed message to the server. However the problem here is that even though I can verify the integrity of the message itself for that public key, I can't really know if that public key is allowed into the system.

I'm really baffled at this point so as to what I can do. Why I'm worried is because this system is supposed to be secure at the point where when I give the source to someone else, they shouldn't be able to modify the algorithm to the point where they can associate actions with users.

EDIT: I guess I can word this as an anti-PKI.