3.a When generating an anonymous coin, generate also OTS keys $pk,sk$, then commit to both the serial number $S$ and to $pk$ (we don't publish in the clear either one). When paying a coin to some node $i$ publish both $S$ and a signature on $i$ with $sk$ and provide a ZK proof that there exists a commitment among all the anonymous coins to $S$ and a verification key $pk$ that such that the signature on $i$ is valid with respect to that key.