This approach is just fine for the industry: delegate the problem to the lowest, shadiest bidder. After all, privacy breaches aren't their problem. If governments want an ID system they should provide one.