That has the same issue as a lot of privacy-protecting age verification services, which is that there's never actually a moment when someone verifies that you are you.
Like, if someone sold their key and password to a few people, it would still work everywhere and there would be no obvious reason for the key to be revoked. All it takes is one poorly implemented (or malicious) website to capture everyone's keys and passwords, and then they sell them to kids.
I don't think there's a way to avoid that issue. You can either implement privacy or verifiability, but not both, and governments are going to trend towards verifiability.