That's just introducing a complex new vector for compromise without getting out of the dichotomy. Option 1: Bob gets a credential that can be traced back to Bo

That's just introducing a complex new vector for compromise without getting out of the dichotomy. Option 1: Bob gets a credential that can be traced back to Bob; privacy fail. Option 2: Bob gets a credential that cannot be traced back to Bob, shares it with everyone; defeats the system. Notice also the tradeoff you're forcing for no benefit. If Bob has a unique blinded signature, even if the signer doesn't know the unblinded value, the verifier would and so Bob has to get a new signature for each use or the verifiers could correlate one use with another. But needing a new signature for each use creates a timing attack because now you can see that every time "someone" presents a signature to use a particular service, Bob had just requested a new signature. In this context blinded signatures have only costs and no benefits over universal shared passwords.