Right, we have no legally binding restrictions on online activities - yet. Which makes it a gray area. Yes, you can browse and buy 18+ games on Amazon 24 hours a day, but you need to verify your age with the courier on delivery. That obviously isn't possible for digital distribution. You can still browse 18+ games on the eShop 24 hours a day, but you can't buy them until 11pm. Nintendo uses laws meant for TV stations as a replacement for PostIdent. That might still get them into trouble, but gives them a certain level of legal safety until proper laws are in place.
There simply is no accepted age verification for online transactions in Germany. Credit cards and even passport numbers are not sufficient. Companies tried, didn't fly when challenged in court. The only legally accepted way is to verify an account in person, via PostIdent for example. That's what porn sites do. What Nintendo could do is to issue BSI certified, NFC enabled smart cards and PINs for users wishing to access 18+ content and send those out, with PostIdent. That obviously wouldn't be free or very convenient, of course.
Every other company isn't in Germany. Also, the safest route would be no 18+ content at all (the way it used to be on PSN and still is on 3DS eShop), the most inconvenient route would be verified accounts.