Voting scheme where the votes become public when a threshold is reached Does there exist a voting scheme where voters cast private encrypted votes that automatically become public only after the threshold number of votes is cast?

It needs to be done without a central authority that is trusted to hold keys. I don't need it to be receipt-free, I just want it to be authority free and automatic.

The reason why I need this is, that seeing other people's votes before the threshold is reached could bias the final outcome.
I am making the following assumptions regarding your requirements:


The number of participants is low enough, for it to be feasible for each participant to open a reliable, authenticated and confidential communication channel to each other participant.
The vote of each individual participant is only meant to be kept secret until the threshold of votes has been reached, at which point it becomes public how each participant voted.
System parameters $p, q, g$ are selected in advance, such that the discrete logarithm problem in a sub group of prime order $q$ of might be assumed to be hard.
The participants should not be allowed to change their votes once their votes have been cast, and collusion between participants must be prevented.
The risk of individual participants invalidating the election by opting out, is relatively low, and when it happens, it can be dealt with by starting over.


Given the above requirements, a simple approach would be to combine a binding and computationally hiding discrete logarithm based scheme with Shamir Secret Sharing. 

Steps: 


Each participant $P_i$ selects a value $x_i$ uniformly at random from $\mathbb Z_q$, calculates $h_i = g^{x_i} \bmod p$, and broadcasts $h_i$ to all other participants.
Each participant computes $h = (\Sigma_1^nh_i)^{(p-1)/q} \bmod p$. If $h$ equals zero, step 1 is repeated. (Extension: Each participants broadcasts $h$ and some protocol is in place to disqualify users who broadcast a value the majority of the other users find to be incorrect. For simplicity, this has been left out at this stage and the rest of the stages of the protocol.)
Each participant $P_i$ selects a degree $t$ polynomial $p_i(x)$ with coefficients $a_{i,1},..,a_{i,t}$ selected uniformly at random from $\mathbb Z_q$ and $a_{i,0}$ representing the vote of the participant.
In order to vote, each participant $P_i$ selects $n$ values $r_{i,j}$ uniformly at random from $\mathbb Z_q$, keeps them secret, broadcasts a commitment sequence $C_{i,j} = g^{p_i(j)}h^{r_{i,j}}$, sends $p_i(j)$ with confidentiality and authenticity to each participant $P_j$ who has already voted and gets $p_j(i)$ back from $P_j$.
Once at least $t+2$ votes have been cast, each participant broadcasts its $r_{i,j}$ values and all of the $p_j(i)$ values it has received from other participants.
Each participant verifies that each value $C_{j,k}$ it received when user $P_j$ voted, meets $C_{j,k} = g^{p_j(k)}h^{r_{j,k}} \bmod p$. (If not, some protocol has to be in place to disqualify users.)
Each participant solves the shared secret of each other participant and broadcasts the result.
Some protocol is in place to confirm that a majority of the participants have broadcasted the same result.


Q: Does this protocol really prevent collusion?

A: Strictly speaking, no. Nothing prevents the participants from conducting informal out-of-band exit polls during the voting in step 4. No protocol has any influence over what the participants do out-of-band, so this is something that has to be dealt with out-of-band as well.

Q: Is the Shamir Secret Sharing component really necessary? Since all participants who vote have to be online during the entire protocol, wouldn't a commitment scheme and a counter be sufficient?

A: If the possible votes are "Yea" (1) or "Nay" (0), using Shamir Secret Sharing allows a minor modification to the protocol, by which the total number of votes are counted before each individual vote is revealed. Each participant $P_j$ reveals the sum of the $p_i(j)$ values. Together with the corresponding sum of $r_{i,j}$ values, this sum can be verified using the commitments. Reconstructing a polynomial from those summed up shares, will equal the number of "Yea" votes. 

Now, if some participant (e.g. the last one to reveal its sum) chooses to opt out, this user might be disqualified and the rest of the participants might wait for the next vote to be cast. No individual vote will have been revealed (through the protocol), but it is possible that the disqualified participant already knows the result (and is the only one who knows it).

Q: Isn't constructing the $h$ generator as a sum, rather than a product, susceptible to doctoring by the last participant to submit its $h_i$ value?

A: Not if we assume that $q^3 \lt p$ and every participant verifies that each $h_i$ belongs to the $q$ order subgroup. Also, constructing it as a sum allows for each participant to open their $x_i$ value, to prove that they know the discrete logarithm of $h_i$, without making it possible to calculate $log_g(h)$