The government, obviously, when the sites call it to check their tokens
You are describing strong surveillance. Exactly the problem ZKP (or similar tech) solves/avoids.
And on the other issue, requiring sites to verify ages before serving adult material, isn't the same as criminalizing shared/mishandled age verification credentials. Its a mitigation issue, not a nuclear threat.
I am left wondering if you had any coherent point to make.
It isn't news that adults can be irresponsible with age-verification credentials.
Letting children use adult's credit cards isn't criminalized either.
Adult sites not default-serving underage users does not require fine-grained surveillance or criminalizing clueless parents/adults.