EU Age Verification Project Mandates Hardware-Bound Attestation

The EU's open-source age-verification project requires hardware-bound attestation to prevent credential copying, but this mandate has sparked criticism for potentially limiting access on Linux systems, custom Android ROMs, and independently compiled applications. The project's architecture depends on approved devices, operating systems, and attestation providers, raising questions about whether a real-world implementation can remain truly open when access requires supported security hardware and whitelisted applications. The maintainers have committed to publishing a security review and threat model to justify this trade-off and explore alternative approaches.