I wonder how the whole age shenanigans are going to be implemented. In my limited understanding it would be tricky to do it double blind while not allowing spamming and have zero trust requirements for data.

Maybe something like service - > user, user scans qr code, signs, sends to provider unique request, user - > EU, EU verifies only user data and signs and service can check.

But then if the service checks in with the EU the EU knows which user accessed which service from the url and you have to trust the EU to not keep track of where the request came from.

I guess if something like this will be open source then GDPR could be used to prevent that from being logged. I don’t know, I’m rambling now.