So on step (3), the mint cannot do stuff like "rate limit" the amount of re-assignments that happen on the "same" banknote? 

Auth is obviously a no-go. 
And the mint wants to make money, so yup I get it. 
Sucks for the UX tho. 
Paying ⚡22 to zap ⚡21 isn't the same 😿