When you show a credential there's a protocol whereby the showee has assurance that the shower possesses a credential of the particular type without actually seeing the bit string.