So we generate tokens prior to going offline? 

I could see that working I suppose...
Except if the sender gets online before the receiever and claims back, right?

Or am I missing something? 

 Ah, I just realised what you meant with different trust assumptions, gotcha!