It should be out in the next day or so.
Edit: Looking into it, it seems like this uses the same mechanism for tokens as Cloudflare's turnstile system: https://privacypass.github.io/ or for the proper standard https://www.rfc-editor.org/rfc/rfc9578.html
Excerpt that explains how it works:
> When an internet challenge is solved correctly by a user, Privacy Pass will generate a number of random nonces that will be used as tokens. These tokens will be cryptographically blinded and then sent to the challenge provider. If the solution is valid, the provider will sign the blinded tokens and return them to the client. Privacy Pass will unblind the tokens and store them for future use.
So it seems like as long as the cryptography is done right and Kagi's webextension does what it says, they are actually private.
(Firefox extension is not found. It's probably not in the store yet. Can't find with search either.)
If you're going to start trusting search engine companies then maybe don't have them linked to your bank account. They can put what they like in a policy document but the problem is what happens when they decide to start doing things differently.
