My understanding is that the key feature of a blind RSA signature is that the signer is unaware of the contents of the message being signed.
How is this different from simply appending a random salt to the message and hashing it? Wouldn't feeding that hash to the input of the RSA signing function accomplish the same thing?
Whoever knows the message, the salt and the signer's public key can then verify the signature. Or, whoever has the hash and the signer's public key can verify the signature. Meanwhile, the signer only knows the hash of what they are about to sign, so it seems that it accomplishes the same task - the signer is unaware of the contents of the actual message, and cannot link the signed hash to the original message without knowing the original message.
What is the rationale behind introducing blind RSA signatures, rather than using the method described above?
Is there some property that even after the original message is revealed to an attacker, it still cannot be linked to the signed message? Is that unlinkability?