I believe that with technologies like IRMA/Yivi (https://irma.app/docs/what-is-irma/ https://irma.app/docs/what-is-irma/) this could be done securely and privat

I believe that with technologies like IRMA/Yivi (https://irma.app/docs/what-is-irma/ https://irma.app/docs/what-is-irma/) this could be done securely and privately, though I wish the app wasn't so centralised in its token exchange. For this use case (with the government playing a role in the authentication already), that wouldn't be an issue, though. Permitted services could request minimal data tokens, verified by one or more instances of choice, and the user would see the data being exchanged and with what party the data is being exchanged exactly. In my opinion, this beats a lot of current implementations, which redirect to either a plain government login or bank login, where the backend does all the data exchange. I have to admit that I haven't done anything with this tech myself because I can't be bothered filing a request for access for such a system. Still, I can see the potential here.