We could split the difference and users could get auto-notified if their vote was viewed and by whom. That way it’s a two-way street. The mod/admin can see your votes, the users know that their vote was accessed by that mod.

It would be pointless to do. Anyone can view your votes without notifying you. Just set up your own instance, download the data (that you need to do anyway because of how activitypub works) and then just open up the database with a different software to access the data. No notification can be sent because the application doesn’t know the data was accessed.

Second choice would be that all users are anonymized by a hash so that bad vote actors can be removed via their hash being associated with malicious or other bad acting, but to discover who individuals are the admin would have to do the legwork of follonf multiple posts/ comments to associate the hash.

This opens a door to vote manipulation because

No perfect solution.

Don’t know how that would be implemented, but someone needs to watch the watchers.

Otherwise hide the votes if trust of anonymity is paramount.