With my implementation, the government revokes the code after it's been verified once. If you want to verify elsewhere, you need to request a new code.

How does that work with your implementation? A token given to you can be verified as legit by anyone using a public key, but there is no way to revoke it after a single use(because you have no way of knowing it's been used, by design).

The service (e.g. the porn website) keeps a list of used tokens and refuses to reuse them.

You can use the same token on multiple websites, but then you leak metadata. As for the age verification "protection", I don't think it makes it worse, given that anyway someone could get a token and give it to a kid.

Again, I don't think that the goal is to make it absolutely certain that no kid will ever access social media or porn. When you go to such extreme, you need dystopian technology and I don't think the juice is worth the squeeze.

My opinion is that age verification may (maybe?) be a tool to make it slightly more inconvenient for kids to access some services. But I am not completely convinced that it is always desirable. Instead of accessing a mainstream porn website, they may end up downloading random stuff from the internet, including malware and possibly violent porn, which is probably worse.

Social media is a real problem, but again... if a kid goes home and tell their parents that they are excluded because everybody else has TikTok, won't the parent get a token and install TikTok? Right now no parent wants their kids to use social media (or even have a smartphone), but they do it because all the other kids do, and kids need to conform.