Earlier quoted context omitted.
Imagine you are visiting hacker news, and for some reason you have to prove your age, but you don't want HN to know who you are, nor your age identity site to know you're going to HN One way to do this off the top mf my head would be HN issues a unique number (say 4096 bit) to you when you create an account You send that number to your identity provider along with confirming proof of age The identity provider signs t…
That sounds better if you don’t trust the websites but worse if you don’t trust the government or the central checker.
As someone else points out, you send a message to your ID provider 17 requesting the minimum required fields and an anonymous token provided by HN, the ID Provider returns that (over18=yes, token=1234567....) which is signed, you then send the returned payload to the server you're asking, saying "I used Identity provider", and HN (assuming it trusts your ID provider) can confirm that.
HN knows the IP you're connecting from and the identify provider (say the Austrailian government)
The Austrailian government doesn't know where you're connecting to, just that you are trying to prove you are over 18. The unique random number HN provides confirms it's not someone else's token, but it doesn't link to HN
I assume there's a proper standard which does this