this is really cool. i like your description of zcash and the idea here. it sounds reasonably intuitive, though i'm unfamiliar with zk proofs so i'm unable to verify it. :)

one note from reading through:

So the voting power a shielded voter has, must either be frozen at proposal start time..

we do all of our voting power as a function of block height so that this is the case. from your earlier interface, this makes it:

pub trait VoteModule {
  fn voting_power_by_addr(&self, addr: Addr, height: u64) -> Option<Uint128>
}

allowing voting powers to decrease may be fine though, so long as we don't also allow increases.