Someone has to hand the browser the token. And that token has to validated by someone's backend. You now have an issuer with knowledge of who a token belongs to

Someone has to hand the browser the token. And that token has to validated by someone's backend. You now have an issuer with knowledge of who a token belongs to and a visited with a record of where they were. They go over this on that very page: > (unless M = 1)... > If the server uses different values for their private keys for different clients, they can de-anonymize clients at redemption time and break the unlinkability property... > If the issuer is able to use network-level fingerprinting or other side-channels to associate a browser at redemption time with the same browser at token issuance time, privacy is lost. This is why Mozilla rejects the proposal. We just have to trust issuers to be good and then trust that neither issuers nor websites will "accidentally" log these tokens where a data leak creates a papertrail to real-world identities.