> As a result, it really tells us — and everyone else — nothing about you. All it does is stop you from being able to sign up again.

Which means it tells them something about you.

What about this scheme prevents identification through somebody scanning your iris to get your hash on the pretext of a legitimate purpose, then connecting your hash to your actual identity and passing it on?

This seems like a large risk, considering how many companies exist entirely to compile data from disparate databases into a single record. The existence of those sorts of businesses is why there is no such thing as an anonymous unique identifier.