There's two entirely different classes of control out there. A state database will may be centralized, but it's also much more accountable to established legal

There's two entirely different classes of control out there. A state database will may be centralized, but it's also much more accountable to established legal norms. Private systems run on their own internal rules, with less formality, appeal process, and recourse. A major "control" issue is acceptance. A card network can decide (for example, based on fear of public embarrassment, angry stockholders, or pressure groups) to cut off anyone they don't want. The federal government would be tied up in the courts for decades if they acted equally precariously. So it's actually potentially a more reliable choice for "hot button" products like porn, guns, VPN service, etc. I'd expect the risk of disclosure will get fairly tightly clamped down. With the current system, there are a lot of middlemen and law enforcement or just snoops can find someone to socially engineer data out of it. Make it a federal thing, and I'd expect there are a lot stronger legal protections and rules available than just "ooh, if PCI hears about it they might complain". If these rules aren't there on day 1, two weeks after first time the local news busts a Senator for paying callgirls with FedNow, they'll be there.