Hash-chains allows the solution to be token-less. You no longer need those per transaction information leaking API calls. You also avoid dependency on a single provider.

The communication in connection with a transaction would only go between the identity owner (Bob) and the provider (Cycle shop).