why wouldn't an identity/age verification scheme that blinds both sides work?

e.g. a site wants to have some proof of identity. it generates a token and sends the user with it to a government service. the service verifies the user's identity, signs the token and sends the user back.

now the site knows that the government service has verified the identity (and relevant characteristics, like age threshold), but doesn't know the identity. the government service obviously knows the user but doesn't know the online account tied to the identity. this can be further separated by using a middleman authentication provider, so that even the site identity itself doesn't reach the government.

am i missing something obvious why that wouldn't work?