You will always give up some privacy this way, but there are better and worse ways of doing this with some combination of cryptography and trusted third parties

You will always give up some privacy this way, but there are better and worse ways of doing this with some combination of cryptography and trusted third parties. There are already online ID verification services for all kinds of apps. Most of the EU's EIDAS proposal - apart from the "we control your TLS certificates" paragraph - is about building a reliable online identification service that preserves as much privacy as possible. I think one of the ideas is to be able to prove you are (or at least hold the ID card and PIN of) an 18+ EU citizen, without divulging your identity. Part of the bill is then to make it mandatory for businesses that want to do citizenship/age verification to accept this method unless they have a really good reason not to. Once you've verified someone's ID, if the law doesn't require this then you don't have to save it in any form, so all a hacker would get if they break in to the database later is that the boolean flag is_verified is set on a particular account (along with the usual things such as the password hash and the email address). For comparison, I'm always a bit uneasy when a site needs my mobile number "to verify you're a human and prevent spam" but they definitely won't save it or use it for marketing purposes - I don't trust everyone. But I would trust a properly designed and audited privacy-preserving ID protocol, just like I trust using the same yubikey across different sites.