Nobody ever asks why this has all become "necessary" even though it is literally the poignant question. Why do we need such ridiculously strong attestation of identity? How did the Internet get along so far without it, if it's really needed?
Well, nobody is actually proposing this at the moment. Heck, neither Apple nor Google's scheme even gets close. All their schemes purport to do is ensure the "integrity" of the platform.
Integrity how, exactly?
> For example, this API will show that a user is operating a web client on a secure Android device.
So basically, it does not tell you that the user is a unique person, or give you any kind of usable identifier for a person. All it tells you, in case of this example and Apple's, is that the device is not rooted or jailbroken.
In practice, is this concept useful? Only as part of a larger cat and mouse game. Just like copyright protection schemes, remote attestation schemes are limited by what they're actually attesting. Very little can be done to stop cam rips in movie theaters, or any number of in-between steps that exploit the fact that a movie is just a series of pictures and frames of PCM samples at the end of the day. And likewise, devices may be expensive, but there's nothing stopping someone from acquiring many of them to do operations on. In fact, many people already own swaths of Android devices specifically for cheating the system. When they can be had for as cheap as $50 a pop in some cases, it's not really a meaningful barrier.
So what does this actually do? It just makes it more expensive and complex to run bot operations, and if you can raise the cost enough to sink the break-even point of doing so, then theoretically you've won! ... But it won't, because there's a lot to be gained by spamming and scamming people. All of these years of countermeasures and we're not even close to getting there. The amount of money that flows in the industry of cheating these systems is more than enough to just pay the cost.
Adding government IDs to the mix won't change anything. Almost every SPAM operation has a real person behind it, so getting a blind attestation that a person is indeed a citizen tells you almost nothing about them. I think just about the only way that could aid in any way is if it were set up in such a way that you did in fact receive a unique ID for each person, rather than just an attestation that you're dealing with a legitimate thing.
And if that's the end game of the Internet, then honestly, the whole experiment was not worth it.