I have conserns about privacy pass protocol. Can't the server abuse the protocol? What if sT is always 2T? For the record, I don't like captcha. About finger

I have conserns about privacy pass protocol. Can't the server abuse the protocol? What if sT is always 2T? For the record, I don't like captcha. About fingerprinting "budget", asking users for consent is useless to protect users that can't for any reason change to another app