One approach might be for the Site to expose a public key (like SSH, completely independent of TLS/hosting) which the User carries over to create the Burn Trigger.

The Attestor which generate a random secret associated with Burn Trigger record, and encrypt it with the public key to create a challenge.

To burn the token, the Site would need recover the random secret with its private key and supply it. That would also replace the need for a confirmation code in idempotence.

A malicious site would not be able to secretly spend unless it also stole the private key of the place it wanted to spend it at.