The bit-contract idea is neat, although it seems like it could be misused. A group of dishonest buyers could gang up on an honest seller and inflict a worst-case N x (penalty + item_cost) damage at a cost to each buyer of (penalty - item_cost). The seller damage is only N x (penalty - item_cost) if the seller waits until they have payment before shipping, though, so I suppose you'd need a very high N to impact a high-volume seller that can verify quickly. Seems reasonable for low-profile or low-volume sellers, though.
