it didn't have to be like this. If we had trusted NGOs with strong funding and a track record of independence and integrity they could shim between token genera

it didn't have to be like this. If we had trusted NGOs with strong funding and a track record of independence and integrity they could shim between token generation and application. Allowing governments to produce identity tokens and applications to verify them with the shim blocking each side from knowing of the other. But we don't have that, so he's probably right.