I too think this is likely the only workable solution. My bias is the OS/ecosystem layer is the right place to handle access to the digital world.

However as digital access becomes more and more essential to doing anything in life, this makes the layer even more load bearing, so I wish to see a legal framework for privacy/security as well as appeals process for the painful edge cases where people get locked out for whatever reason. That problem is even harder.