How are those tokens less complicated to use than a private keypair? How do you ensure that the votes are cast anonymously, without leaking metadata from timing, etc?