It's a great question, and top of mind (as I considered applying for the open Deputy Director role running Login.gov that recently opened up, and prepared accordingly).
Privacy must always be a first class citizen as it relates to digital identity solutions, and any compromise must be as minimal as possible. Trust alone is not enough, the stakes are too high, and the history of breaches and data loss (both public and private) speak for themselves. I would argue that Login.gov, GSA, and the federal government aren't attempting to control state business, but are acting in service of it. They are a vendor, and if states and local govermnet choose to implement in a manner that allows for pluggability (in order to prevent vendor lock in to Login.gov), that would be reasonable (encouraged even). Login.gov should be chosen because it is the best solution, not the default solution because of .gov. If states and local governments wish to fallback or opt to other solution providers who meet digital identity regulations, they should be able to do so. It is above all, a partnership, not a power hierarchy.
I would also say that governance and transparency are non negotiable, and should be enumerated both contractually and in statute. What Login.gov stores, how long it stores it, how data privacy and security are addressed should be documented and attested to. And most importantly, Login.gov should not have the ability to deny service once onboarded without exceptional cause (codified in statute). It should be treated like a utility: inexpensive, reliable, trustworthy, to the point you forget it even exists. It should Just Work.