The idea would be a connection requires the key so you could both verify at more than one website and be limited to one instance per website.

If you use the same token on more than one website, it's not privacy-preserving anymore.