Indeed. I don't see why the verification process has to be done once per user per website, instead of once per user. That maximizes costs, inconvenience, privacy risks, and compliance failures.