Couldn’t malicious instances use random users aswell? What if there’s some sort of user manifest that shows all users an anonymous hashes belonging to that instance? That way you could check there are the same number of both.