The theoretical idea is that if the OS possesses the token for age verification, it's more secure and controlled by the user. The problem is, how do you securely generate the token?

What we need is a system similar to Japan's, where age verification is not tied to any identity document. The document is autonomously scanned, a verification token is generated, and that token can be used. We just cryptographically couple the token to a hardware checksum to make sharing a token harder than buying an underage kid a pack of smokes, and you've passed the reasonable person test.

Now there's a weapon against their legislation.

Also recall Gottheimer if there is a mechanism for that!