You're right that, in practice, the net of compliance is already all around us — and tightening. But conceding that service providers must always pre-emptively align with the most paranoid interpretation of the law is what cements this trap. It’s the normalization of this posture — not just the regulation — that kills freedom. Self-issued credentials aren't magic; they’re leverage. They allow people to present proofs without revealing identity. That means the question shifts from “Who are you?” to “Can you prove you meet this requirement?” If a law mandates age verification, for example, then a ZKP-based attestation that you’re over 18 should suffice — without revealing your name, face, or full dossier. The current system chooses not to accept this, not because it’s insufficient, but because identity harvesting is the real goal.