Anonymous credentials: an illustrated primer (Part 2)
blog.cryptographyengineering.com