I don't think it's as intractable as people make it out to be: require porn sites to do some level of due diligence. "But what about sites outside of US jurisdiction (e.g. Russia)?" Require ISPs to have a setting for customers to opt into blocking them. The reality is no one in my household ever has any reason to communicate with Russian, Chinese, etc. or even almost any European servers (maybe there could be exceptions for news, government, and university orgs), so it makes sense for us to just block them.

There you go. You just eliminated pretty much all access for children to online commercial providers.

It's not perfect, but that's a silly reason not to do it. We don't let kids into adult bookstores just because they could (currently) easily get it online. We don't let them buy drugs and alcohol at stores just because they could find an older friend to get it for them. It is already illegal to provide porn to children. Businesses (mostly ad-based ones) have just been getting away with being completely negligent about it for the last 10-20 years.

The Utah law for example seems to specify that either the user provides a digital id, which seems to be a sort of signed message from the state that they've saved into a secure element (so not doing realtime checks with the government. It's not really specified how it works, but it says they can save an ID file to their phone), or use a commercial knowledge based auth solution. So yes, it seems that it's been specified such that the government does not get access to that information.