For many purposes, we need anonymous authentication. I haven't heard about much innovation on that and similar privacy fronts in awhile.

Off the top of my head, a possible method is a proxy or two or three, each handling different components of authentication and without knowledge of the other components. They return a token with validity properties (such as duration, level of service). All the vendor (e.g., Polis) would know is the validity of the token.

I'm sure others have thought about it more ...