Two QR codes: one of the ticket's public key, and one of your public key. Their infrastructure verifies that you're the current owner and you're in.
Or just have your phone broadcast the public keys via radio to a turnstile.
Or just have your phone broadcast the public keys via radio to a turnstile.
Thus, anyone can make QR codes that show the 2 public keys. It's trivial. This is the "showing a picture" scenerio I mentioned above. Anyone can show the right picture, especially since the picture that needs to be shown is public information.