this is sounding sketchier and sketchier. so every website that serves 18+ content in Denmark will need to check tokens against a central database upon login? forget censorship and surveillance, that sounds like it plain won't scale well. also does Denmark really expect every website to implement this? what about Lemmy or other fediverse services?

why is this needed at all? why not just use parental controls on devices? why is this such a crisis now, for the first time in 20 years?

I feel like they could just, you know, not do this.

I wouldn't call that an ideal implementation, but if they implemented it properly, there's no way for the website to know who you are, and there's no way for the website to tell the authority you visited their site. If there is, it's not actually a ZKP and it's a failure of the technology (and I assume at that point be against the law). The only abuse that should ever be possible is that the authority knows you are using tokens, not where.

The only required trust that should be needed, is that the authority proved your age in the first place, such as when you get your drivers license, and that they actually implemented all the cryptography properly (which a 3rd party could verify)

Edit: And if there's concern about token sharing somehow, it should be locked behind your biometics in a way that again doesn't leak any information, which they saw you encode when they verified your identity.

Edit: think something like a programmable credit card with a key that can't be removed, but the card can be programmed with an age by the authority and locked by a biometric. You go in, plug the card in, they add the age and their part of the key, you scan your fingerprint on it, and then you're done. They never see your key. You then use it anywhere it's needed and it never goes back to the central authority. Give it a limited lifespan so it has to be renewed once a year or something.