[notpushkin]

> You could run a modified client that lets you assume any identity you choose

Provided you know the secret key to a government-issued certificate. Making it impossible to copy said certificate is not really a requirement for identity verification.

[subscribed]

Some countries fixed it already, see Estonian ir Polish IDs with digital layer (performing signing, authentication, etc), and the devices only acting as untrusted interfaces to these.

[notpushkin]

It’s still impossible to extract an Estonian certificate from the smart card (or Mobiil-ID/Smart-ID), no?

[subscribed]

I believe do, I didn't see a successful attack yet.