Agreed CISA is probably the target for a lot of positive growth in US defensive security. So I get the direction you're going, but then this stands out: > if y

Agreed CISA is probably the target for a lot of positive growth in US defensive security. So I get the direction you're going, but then this stands out: > if you have mobile apps that can perform the identity proofing This is assuming folks have a certain tech pattern of: a) smart phones on the right OS version b) smart phones properly patched such that an Android vuln on a cheap phone doesn't lead to your e-SSN getting compromised c) number locks on their phones to prevent SIM swapping, if there's a non-app option d) have a smart phone in the first place! The risk model there just gets nuts when phones are involved (as a specific counter), at the benefit of including 2FA reqs and somewhat hazy income equality judgements on users (a lot of folks don't have smart phones). If you're really into this, definitely look into mobile security concerns and the ideas around tying identity into it. Cellular network security is... not like internet security assumptions. That's on top of some really generous trust in US identity security practices... the OPM hack really has to be accounted for in this discussion, if in fact we're unifying IAM. Also, didn't Estonia's root cert get popped or something to do w/ low entropy keys on their ID cards from the manufacturer, leading to a total reissuance?