And what prevents a Malicious Actor (older student? friend who already graduated? someone who wants to sell them?) from acquiring multiple of said age verification tokens from different vendors? Well, now there has to be a database somewhere of all of the tokens that have been created along with the ID number of the person who acquired the token. Who maintains this database? The government? The companies who we don't want storing our data?

Sure, it adds more steps than just "click this checkbox if you're an adult" but kids/teens are a crafty bunch and, unlike drugs and sex, a) the penalty for violation of the rules is not immediately obvious (to the youth, OR even to society) and b) the act of violating the rules is not obvious in itself to people who aren't on that person's phone: there's no physical items left behind for parents to notice.

Effectively what we're talking about here is trying to solve the Sybil Problem, which has no widely-accepted solution.