Sequence of Encrypting RSA like Chaum Blinding scheme
A much better way to choose r is

while 1:
    s = random.getrandbits(KEYSIZE+privacyparameter)
    r = 1+(s%(n-1))
    if gcd(r,n) == 1: break;


.
privacyparameter is chosen by the blinder.

If $\:$ gcd(m,n) = 1 $\:$ then the statistical distance between the distribution of blinded_token and

the uniform distribution on units mod n is less $\:$ n/((2^(KEYSIZE+privacyparameter+1))-(2*n)) $\;$.

The signer does not need to know or care what that value is.

It's much better to create $\;\;$  blinded_token $\:$=$\:$ (m * (r^e % n)) % n $\;\;$,

so that the size of the output won't leak much information about m.

The signer computes $\:$ (blinded_token)^d % n $\:$ and sends that to the blinder. $\:$ If the signer instead

signed or decrypted the token in the standard way, then the blind signature scheme wouldn't work.

If $\;\;$ (signers_response)^e % n $\:$=$\:$ blinded_token $\;\;$ then output

((signers_response)*modinv(r,n)) % n $\;$ as the unblinded signature, else reject.

There are two further subtleties for this blind signature scheme:

gcd(blinded_token,n) = 1 $\;$ if and only if $\;$ gcd(m,n) = 1

However, as alluded to in the one of the OP's comments to this answer,

the hash can to chosen to guarantee that $\:$ gcd(m,n) = 1 $\;$.

(So, hopefully, "sha_digest" is something that does so, rather than just one of the SHA functions.)

Also, if the RSA function does not define a permutation over $\mathbb{Z}_n^*$, then blindness

does not necessarily hold even if all relevant values of m satisfy gcd(m,n) = 1.