The whole point is that the token itself doesn’t have any personal info attached to it, only a yes/no and expiry time.
I’ll even one up my original suggestion - it uses standard public/private key encryption, where the government issues a simple json token with a yes/no Boolean and a TTL. The public key that can decrypt the tokens is public. Pornhub then decrypts the token and verifies the boolean and expiry date, all without talking to the government at all.
The whole point is that the token itself doesn’t have any personal info attached to it, only a yes/no and expiry time.
I’ll even one up my original suggestion - it uses standard public/private key encryption, where the government issues a simple json token with a yes/no Boolean and a TTL. The public key that can decrypt the tokens is public. Pornhub then decrypts the token and verifies the boolean and expiry date, all without talking to the government at all.