> In practice this means no rooted/jailbroken phones.
Personally - this is less acceptable to me than just having the site collect my image/id.
I'd support just putting the id in a dedicated device (ex - gov issues smart key) or just accepting that sometimes people will share id info (just like... physical ids).
It doesn't even close all the doors to transferring ids - since I can still just hand someone a phone (just like... physical ids).
If you use physical ids to verify your identity, they normally verify that your face matches the image on the id, no? That’s not possible for web id.