You can treat the 'approved' services list using a whitelist, like a CA.

The other issue is that none of this is necessary. If I want to prove to Person X that Gov Y says that I have property Z, why can't I just present a cryptographically signed certificate saying I have property X. You could even have a similar revocation list as CA.