After verifying that you work for a company, why don't they physically destroy everything that could be used to de-anonymize you, leaving with only some kind of public key and a proof of that you work for company X?
For the legal part I think there were some countries (IIRC Sweden) that doesn't require to keep any logs so that they can move operations there with an owned company and legally anonymize users.
I know it's much easier written here on HN than actually done, but that should be the intention: anonymous by design ground-up.
// edit: fixed "do" to "don't" on first line