Paper on lattice-based shuffle arguments via subset checking, with Ajtai commitments, ciphertexts, and benchmarks, naturally.