Yeah that makes sense. But I'm not sure the token should only be generated upon a successful transaction. This would make vendors not want to issue the token if

Yeah that makes sense. But I'm not sure the token should only be generated upon a successful transaction. This would make vendors not want to issue the token if something goes wrong. When the buyer creates the unsigned multisig transaction, he could request the token from the vendor, so the buyer gets a token in exchange for the unsigned transaction. The token could simply be a unique, random number signed with the vendor's public key. Upon completion of the transaction (multisig transaction is signed by two parties and published to the network), the buyer could publish a special transaction (the "review transaction"), referencing the vendor's ID (his public key), the token, and the review score/value, along with an optional comment.