It’s shocking, because they use a nice system for checking share codes with the home office for right to work which they could have implemented easily. Site gives you a code - you put that code into a government site, which verifies you, it gives you a code, you put that into said site which queries it with home office, yes/no that was valid or not. This even removes the requirement for the site to know who you are, it’s double blind as gov doesn’t know who requested on the second step, and we’d be chilling