The proposal is for SIGNED tokens i.e. only the govt can issue them, and you need a govt issued ID to generate them. The latter mechanism allows rate limiting. This fixes the problem you outline.