They could just issue a x509 cert with an above 18 attribute and nothing else.
You're not 18 yet?
No Problem we just give you two certs with different valid from/to ranges that overlap and don't give away your birthday.
Problem solved.
You're not 18 yet?
No Problem we just give you two certs with different valid from/to ranges that overlap and don't give away your birthday.
Problem solved.
Because it has no attributes (not even a unique serial number that could be used to track it) the whole scheme is now defeated.