Not my area of expertise, can someone please explain why they can’t just digitally sign the generated tokens?
This work is about the case where you trust nobody and therefore require even the token generator to do extra bookkeeping to prove that it's not taking any shortcuts.