Quite a few actually do require ID-scan-through-email (which is horrible). Or, they simply delegate to a third party video ident service, often in another country (because cheaper).
How exactly is the status quo not much worse than "I give you a cryptographic hash proving that I am over 18, but nothing else, and without the state knowing that this transaction happened"?
How exactly is the status quo not much worse than "I give you a cryptographic hash proving that I am over 18, but nothing else, and without the state knowing that this transaction happened"?