Showing Credentials Without Identification: Signatures Transferred Between Unconditionally Unlinkable Pseudonyms