[ulrikrasmussen]

The article claims this is what the ZKP scheme reveals:

> Here is cryptographic proof that I hold a valid credential proving I am over 18. You can verify the proof, but you learn nothing about who I am.

Is this true though? I am genuinely interested as I haven't looked into the details, but must the user not at least also disclose who the issuer of the credential is so the verifier can verify it against a public key? This also reveals at least the nationality of the user and could be misused to block access to foreigners using VPN.

[stubish]

Yes, of course. All credentials implicitly disclose the issuer by nature. A credential is by definition an attestation by an authoritative source, and meaningless without specifying that source.

Yes, any age verification or identity verification system can be used to implement geoblocking. It actually improves the situation. Currently services who want or need to block access to foreigners have no alternative than to block access to VPNs. With a suitable attestation, a service could choose to allow access from VPNs that come with such.