EU Age-Verification App Requires Hardware-Bound Keys, Sparking Openness Fears

The EU’s open-source age-verification project has confirmed that hardware-bound attestation is a non-negotiable part of its design, not just an implementation quirk. The controversy erupted on the GitHub repo for the project’s Android app after a maintainer told a critic that credentials must be tied to protected hardware — Android’s TEE and StrongBox, or Apple’s Secure Enclave — to stop them from being copied, cloned, or replayed by modified clients. The system’s privacy pitch is genuine: users can prove they’re above an age threshold without exposing their name, birth date, or ID document. But that privacy is bought with a dependency on a narrow set of blessed devices, operating systems, and attestation providers.

The details are more nuanced than a flat ban on open platforms. Hardware-backed key storage doesn’t inherently require a server to vet the whole device, OS, or app build, and stricter gates like root detection, Google Play Integrity, and Apple App Attest aren’t mandated by the reference implementation — those are left to whoever deploys it. The bigger constraint is governance: Proof of Age providers are only expected to issue credentials to apps on a compliance list maintained by the European Commission. Publishing source code, in other words, doesn’t guarantee a community-built binary can talk to the real service.

Linux isn’t explicitly excluded — desktop users could scan a QR code with a supported mobile wallet — but there’s no native Linux wallet, and alternative mobile OSes and custom Android ROMs may fail the required trust checks. A promised security review and threat model may clarify whether less restrictive roots of trust can still comply. Until then, the open question is whether an EU-funded, open-source identity system can stay meaningfully open when real access hinges on approved apps, supported hardware, trusted OSes, and provider policy rather than on available code alone.