We could split the difference and users could get auto-notified if their vote was viewed and by whom. That way it’s a two-way street. The mod/admin can see your votes, the users know that their vote was accessed by that mod.

It would be pointless to do. Anyone can view your votes without notifying you. Just set up your own instance, download the data (that you need to do anyway because of how activitypub works) and then just open up the database with a different software to access the data. No notification can be sent because the application doesn’t know the data was accessed.

Second choice would be that all users are anonymized by a hash so that bad vote actors can be removed via their hash being associated with malicious or other bad acting, but to discover who individuals are the admin would have to do the legwork of follonf multiple posts/ comments to associate the hash.

This opens a door to vote manipulation. If you can’t verify users someone can send random hashes.

Otherwise hide the votes if trust of anonymity is paramount.

The votes still exist in the activitypub. They’re already publicly available, the question is how accessible they should be because right now if you want to track downvotes you need to put in some effort. Upvotes you can already easily check from any mbin instance