The complete fix is the standard one: commit to a single round key before any input is revealed and sign it together with the round parameters, so every client verifies it got the same key and a lying coordinator is non-repudiably caught

This is incorrect. Whirlpool can't be fixed because the coordinator chooses every participant for the round, so it is impossible to prevent or detect Sybil attacks.