Can you offer an example of a situation when the second factor authentifies without identification? Assume a service S wants a confirmation that user U is inde

Can you offer an example of a situation when the second factor authentifies without identification? Assume a service S wants a confirmation that user U is indeed legitimate. The centralized auth service A could receive from S a bunch of data S knows about U, like name, address, phone, SSN, whatever S needs to know about U. Then A should respond whether the fields match the data which A knows about U, without revealing to S any additional data that A may know about U. The problem if a centralized service is that it's a SPOF, and the juiciest target for compromising. I still think that TOTP and personal crypto tokens like yubikey are the most resilient, and technically the easiest, solution to that.