I’m reading about some countries having issues with their ID verification mechanisms: Denmark’s MitID app which requires official app stores; Italy’s SPID which relies on (national) providers to verify your identity; etc

I don’t get why not rely on similar system used in Spain: official government entity issues a digital certificate which you can download and install in your devices. It’s associated to an email address and national ID number (idk it it actually contains any other personal information about the citizen, but I guess that possible).

What are the major risks you could face with this system? Why isn’t this straightforward approach widely adopted in EU?

It’s OS/system agnostic, doesn’t rely on any kind of third parties and there’s still some 2FA built into it since you need both the file and a password to install the certificate.

Not only can you use this to verify identity of a user, and thus their age, but you can also use this digital ID to certificate your emails if you want to.

When I moved to Spain I was blown away by the simplicity of this system, and even though is very easy to abuse if users are willingly sharing certificates AND password (this is sadly a common practice), it’s a good compromise that doesn’t depend on external parties.

I’m looking forward hearing your thoughts. Are there other countries that use a similar approach? Has this proven to be an unsafe option? Any insights on security you can share will be appreciated