Very good writeup.

I'll add a few more things.

- in EU, the age verification is using zero knowledge proofs and as far as I know it's mandatory to do it this way. This means that age verification is created from your digital ID, but it's probably unlinkable to your identity or your other verifications. Of course this would be easily bypassable by anyone, because if you can link infinite number of accounts with one id (and there's no way to distinguish it), they figured out they have to do app attestation. So EU that hates American corporations will force you to use stock Apple device or Android with Google stamp (GrapheneOS, or Linux desktop will not work by default). It's funny, because even the reference implementation is proudly open source. But it can't compile and run it yourself - well, you can, but the age verification will be invalid, because you don't have their attestation keys.

This is not forcing tracking or a privacy breach, but it's forcing you to a walled garden ecosystem of Apple and Google and into digital ids.

Check out https://juraj.bednar.io/en/blog-en/2025/12/08/the-internet-and-computers-arent-what-they-used-to-be-why-your-apps-stopped-working-hardware-attestation/