But you have to specify the pubkey at the time you create the token? if yes, then it's not really offline payment, it's a prepared payment done while online.
Discussion
I think you'd scan / nfc the receiver pubkey in an offline use case (if receiver is unknown to you).
How does doublespend protection work in that case? Doesn't sound doable. You can still reuse the same token to pay multiple people.
As I think of it, you're right - scheman provides ability for the receiver to be offline.
For sender to be offline as well, he would need to prepare the locked token upfront in order to get mint's sig.
OK, that makes sense.
Still an interesting property.
As long as the receiver trusts the same mint.