[theptip]

Yeah the hard case to solve is “prove it’s still <ID principal> that is generating the challenge”.

With GenAI I wonder if images will be considered valid ID for long. “Generate a new video of face with camera pan” is currently hard (not impossible) to forge, but I doubt it will be in a year or two.

You get back to multifactor auth, but then the system is more stateful, and still, what is the incentive not to share your ID & password with underage friends?

(These challenges will also be faced with the OP’s scheme as well.)