You start by not giving everyone an "ID" but a hardware token with a chip in it. The person who has that chip and the corresponding private. The only real atta

You start by not giving everyone an "ID" but a hardware token with a chip in it. The person who has that chip and the corresponding private. The only real attack against that is supply-chain attacks, which is why the government buying such tokens should audit the whole supply chain, and they should either pay for a replacement if the tokens are ever compromised or make the manufacturer pay if it's their fault.