> Instead of requiring the user to give them enough personal data to verify those assertions, it could just ask their certificate authority and receive a true/f

> Instead of requiring the user to give them enough personal data to verify those assertions, it could just ask their certificate authority and receive a true/false answer, without receiving a reason why this answer is true or false. This doesn't preserve privacy though: now your verification authority necessarily hears about every website you visit that wants verification, and can trace your every move. They could absolutely issue you with a wide selection of certificates you could use to independently verify yourself though, preserving privacy all round. A certificate for "comes from the US", a certificate for "is over 21". Come up with a big list of criteria, issue a true or false certificate for each, and then you can provide the combination required to satisfy whatever a website needs to confirm from you. You need an expiry for some though. "You're over 18" is permanently true. "You're under 18" is clearly not, but it's easy enough to set an expiry date. Meanwhile "You're an American citizen" isn't necessarily permanent, but becomes invalid unpredictably. You could publish revocations or just require occasional revalidation though.