If you're fine with "some assembly required" solutions, try using "facedetect" (which simply uses OpenCV) and ImageMagick. There is an example at the following page:
http://www.thregr.org/~wavexx/hacks/facedetect/#blurring-faces-within-an-image
A couple of notes on the example:
- It uses pixelation, but you can easily replace the "-scale" operators with a simple "-blur 0x100".
- Each face is processed independently in the example, which is exactly what you need: you can use "display -crop GEOMETRY" to show the face before the blurring process. With "zenity" or some shell scripting it's relatively straightforward to ask whether to proceed with the blurring or not.
No face detection software is 100% accurate though. You will get both false positives and misses. In particular, the default OpenCV profile is definitely not the best on the market without additional training. False positives are easily worked around with the method you describe, but misses are a different story. Having to review all photos manually might not save you a lot of time. I guess it depends on your accuracy demands.
To show the detection super-imposed use the "-o" flag on a sample of your images and see if the detection rate is adequate for your needs.
