[oliwarner]

Attestation from other services is a good option. I have Apple, Meta, Google, PayPal, eBay, Microsoft, Twitter/X and Steam accounts that —through age of account, and their own identity checks and purchase histories— could attest that I'm probably an adult. This obviously isn't a feature they offer currently, but could. Most are available as a federated OAuth IdP.

You already entrust far more than an adult flag to these services so I doubt the news you like to touch yourself is going to be met with an emergency board meeting.

But if that were a problem, would it be that hard to separate identity from end service with an intermediate AV condom service? I'd personally prefer to not add another leaky abstraction layer but that's me.