I refreshed my understanding of OAuth 2.0 and sure, its typical flows which are meant for convenience do not offer the level of privacy protection as you mention. But if we replace that convenience with some effort from the user, we can get the privacy protection as well.

The flow can be as follows:

The user authenticates itself via government's site and is presented with a page which lets them create government-signed messages using claims provided by the government.

The concerned site can generate a random string during their registration/verification process which they expect to be part of the signed message that the user is to provide them.

The user enters that random string on government's site and checks/selects the age claim for it to be included in the signed message. The government adds timestamp to it and a key id based on the private key which it used to sign the message.

The user posts the signed message on the concerned site during the registration/verification process. The site uses the government's well-known address to fetch the public key associated with the key id (mentioned in the signed message). It then uses the public key to verify the signed message alongside checking the timestamp for recency and presence of the exact random string in the signed message. Ultimately checking the age claim.

So now, instead of providing credit card details, the signed message was provided by the user which the concerned site can validate on its own without the government knowing.