Under GDPR, entities are allowed to ask you to prove your identity and by implication that you actually qualify for rights under GDPR.
Yes, but obviously you've got nothing if you use an US-based service from the US. It's based around companies subject to EU laws, rather than any real notion of citizenship.