I strongly hope we are not stuck here perpetually: There are powerful companies that require privacy even in their conditions of use. For instance, to obtain a

I strongly hope we are not stuck here perpetually: There are powerful companies that require privacy even in their conditions of use. For instance, to obtain a credit card from a bank, you have to sign a document stating that you will hide the PIN of your card. For example, quoting from Section 5.5 in the contract you have to sign to get a Visa Card or Mastercard https://www.cardcomplete.com/media/medialibrary/2021/03/AGBs_Kreditkarten_ENG_0719.pdf https://www.cardcomplete.com/media/medialibrary/2021/03/AGBs...: "The Cardholder must not disclose the assigned PIN, nor any personally chosen PIN (see Item 17.8.), nor the Secure Code to anyone, not even to employees of card complete. The Cardholder is responsible for ensuring strict secrecy concerning all card security details – PIN, Secure Code and mobileTANs received on his/her telephone (to be used for authenticating a ViS/MCID transaction and valid for a maximum of 5 minutes afterreceipt) – and must take all reasonable precautions to ensure that they cannot be discovered by others. The Cardholder must refrain from writing them down on the card, keeping them in the same place as the card, telling them to anyone, or acting in any other way that would allow others to discover these details." Hence, if you have a credit card, you must hide something. A bank, for example, would likely benefit from requiring a secure device for transactions as part of their conditions of use, otherwise it is unclear how exactly we can satisfy this contract as customers, and who is liable in case of problems. A common way to ensure such technical requirements is to refer to a technical standard that the device must conform to. As a closely related example, here is a recent Austrian law, the Registrierkassensicherheitsverordnung (regulation for security of cash registers): https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20009390 https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundes... Note to how many technical standards the law refers to in order to ensure the security of these devices, including AES-256, SHA-256 etc. These technical standards ensure that multiple vendors can participate in bidding and all adhere to the required specifications regarding security etc.