But, whoever’s doing the redacting sees the original right? What prevents the redactor from saying, “here’s what the document really said.” Or “here’s who’s in the image, I saw it before I redacted it?”
Of course, she'll have hanged herself shortly afterward while the security cameras were malfunctioning.
An alternative would be to strip out all obvious known words and only leave unknowns (i.e., names) and then have those fragments reviewed (in a reCAPTCHA sorta way).
Finally, for images, cover all faces and the one by one decide which should remain covered and which should not.
LOTS of work but there are workflows to mitigate the ability for reviewers to connect more than they should.