This is actually a really good point for a different reason: if google can add verification that depends on other infrastructure/parties, this will shift the at

This is actually a really good point for a different reason: if google can add verification that depends on other infrastructure/parties, this will shift the attack vector from just google to other players. So say they require some paperwork or organizational registration, now the badies focus on "how do we generate fake credentials at scale" - which means less work for google.