Most people will be doing the whole process (site gives token, person gets token signed, person returns token) as quickly as possible which limits the candidates for a match. Worse, if the central service is compromised and wants to make it easier for log matching to identify people they could purposefully introduce delays which would make it easier to distinguish people.

Most people will use the same IP address through the verification process which would really make it easy.

Briefly, someone (probably your goverment) issues a digital copy of your ID cryptographically tied to a key in a hardware security module you provide. There is a protocol that can be used to demonstrate to a site that you have such an ID and that you can perform operations on it using that key, and can be used to disclose anything from the ID that you wish to disclose (e.g., what country you are in, or that your birthday on the ID is at least 18 years in the past) without disclosing any other information from the ID.

This avoids the timestamp problem because the issuer of the ID is not involved in verifying things from the ID. They have no idea when or how often people are using their IDs.

So far people working on these systems are using smart phones as the secure hardware with the keys locked behind biometrics. Google's made on open source library for implementing such systems, the EU has one nearing release after several years of development, and I believe Apple's new ID storage in Wallet supports such a system.

The EU has said that they plan to add support for security devices other than smart phones, such as stand alone security keys or smart cards.

This allows anonymity, security (no timestamps comparison), freedom of speech and expression (to have independent accounts not linked to the main virtual id).