The revocation list means nothing when they can get ahold of someone’s older sibling’s ID and sign up for social media.
Did everyone just forget what it’s like to an ambitious kid who wants to get online?
Do people really think a platform that needs people to jump through these hoops and use this imaginary international ID architecture is feasible?
Does anyone really think that kids won’t just set their location to Estonia and/or use a VPN to circumvent all of this?
Revocations are not for the individual ID but if an exploit is found compromising the IDs stored on a trusted element. Your older siblings ID can’t be used to sign for millions of accounts - just those who the older sibling lets borrow their phone that has their ID (and assuming there isn’t some kind of uniqueness cookie that can be used to prevent multiple accounts under a single ID). That’s a much different and more manageable problem (fake ids via older siblings have been a thing for forever).
No, this line of reasoning deserves nothing but absolute contempt when it comes to laws. We are not talking about getting the finnicky API to work at your job. Too often laws have had unintended consequences as a result of loopholes or small peculiarities. If the damn law doesn't even work on a fundamental level then it should be opposed on principle.
If there is no risk involved, everyone will jump on doing it.