It seems like a plain anonymization problem, much like a voting with a secret ballot. If I encountered this problem in real life, I would just use slips of paper and a box with a slit in it. Possible strengthening techniques would involve removing the handwriting, for instance using multiple choice 0-9 for each digit.