Aggregate, k-anonymized ballot snapshots recorded on CanuckDUCK's Hedera ledger — tamper-evident within CanuckDUCK's infrastructure; public independent verification (Hedera mainnet) is on the roadmap