But it also means that if someone challenges the token, the token creator responsible for answering said challenge gets information about services used by the u

But it also means that if someone challenges the token, the token creator responsible for answering said challenge gets information about services used by the user. So it isn't really a privacy preserving solution.