State identity, digital sovereignty, and the hardware root of trust
Europe cannot legislate digital sovereignty because high-assurance state identity requires proprietary hardware attestation from the American tech duopoly.
By Simon Ferris
Sparked by European "age verification" "app" forcing everyone to use Android or iOS · discussion
If you read the elite policy consensus emanating from Brussels, the eIDAS 2.0 Architecture and Reference Framework is heralded as a triumph of "digital sovereignty"—a sweeping legislative blow meant to finally decouple the continent's digital infrastructure from American tech hegemony. This framework is supposed to unify 450 million citizens under a single, interoperable digital identity architecture, allowing them to open bank accounts, sign commercial leases, and access healthcare without relying on private authentication brokers. It is a very comforting geopolitical narrative. It is also, as a matter of database architecture and physical reality, completely false.
To understand the gap between the press releases and the plumbing, we have to map this dynamic using what one might call the Geopolitical OSI Model. In traditional networking, the OSI model explains how a raw electrical signal over a physical wire eventually becomes a rendering of a web page on your screen. In our geopolitical version, we will start at the top with the abstract theory of a sovereign state issuing legislation, descend layer by layer through the operational technical specifications, and bottom out precisely at the inescapable physical requirement for proprietary hardware attestation.
Let us begin at Layer 7: The political mandate. Under the eIDAS 2.0 framework, European member states are required to deploy a digital identity wallet capable of achieving a "High" Level of Assurance (LoA). In the institutional mechanics of state identity, a High LoA operates as a rigid legal standard for absolute non-repudiation. If a citizen uses their state-issued digital identity to sign a commercial mortgage in Berlin or authorize a massive corporate wire transfer from Paris, the state needs that user to be entirely unable to claim, three years later, that they didn't actually click the button.
Consider a commercial bank which integrates with this sovereign wallet to originate loans and onboard retail customers. A functioning financial system cannot operate at scale if users can routinely contest five-figure bank transfers by claiming their phone downloaded a malicious PDF, expecting the institutional risk apparatus to just cheerfully eat the loss out of its working capital. (Fraud losses in lower-assurance systems are generally socialized across the user base via fees and higher interest rates, but a High LoA system specifically exists to drive those institutional losses to near zero by making fraud mathematically impossible to deny.)
Consequently, state identity operates less as a slick software product and much more as a massive, cryptographic liability sponge. To stochastically manage fraud at a continental scale, the state cannot rely on software alone.
Descending our Geopolitical OSI Model to the transport layer, we encounter the hard operational limits of code. Software is infinitely malleable. If your identity system relies strictly on software checks, an emulator farm in a non-extradition jurisdiction can trivially spoof its geographic location, its biometric inputs, and its user intent. You simply cannot allow organized crime rings to bot-net Anti-Money Laundering requirements or speedrun KYC onboarding via headless Chromium. To mathematically prove that a user is a living European holding a genuine device, you have to bypass the userspace entirely. You must ask the silicon.
This requires a hardware root of trust. Cryptographic keys are physically burned into a Secure Element or a Trusted Execution Environment at the factory—typically by a manufacturer in Asia, using silicon designed in California. When a relying party asks for a high-assurance signature, the physical hardware executes the cryptographic challenge in an isolated sub-processor. It mathematically confirms to the government that it is an unmodified commercial device currently sitting in the user's hand.
As we drop to Layer 2, this physical requirement brutally collides with the ideological preferences of the open web, triggering an entirely predictable internet freakout. You can watch the Geopolitical OSI Model break the hearts of developers in real time in a GitHub discussion regarding the technical specification for age verification. Open-source advocates view their smartphones as general-purpose computers which they rightfully own. The state, conversely, views the smartphone as a highly regulated tamper-evident seal. And the technical specification explicitly forces the use of standard Android or iOS distributions to maintain that seal.
This realization quickly spilled over into a sprawling Hacker News comment thread, where engineers voiced outrage over being permanently locked into American corporate ecosystems by their own government. They rightly pointed out that privacy-focused custom operating systems are systematically excluded from the European identity infrastructure. And technically, their grievance is entirely accurate: alternative systems like GrapheneOS routinely fail these strong integrity checks.
(You will note that installing a custom ROM inherently requires an unlocked bootloader, mathematically severing the cryptographic chain of trust back to the original equipment manufacturer. The silicon knows the software layer has been altered, and it dutifully reports that anomaly up the stack. It cannot distinguish between a highly sophisticated privacy advocate and a financially motivated malware installation.)
It is immensely tempting for privacy advocates to frame this exclusion as a monopolistic conspiracy or a failure of regulatory imagination. The state's choice here is, however, entirely rational. A sovereign government simply cannot allow its citizens to Bring Your Own Root of Trust. The systemic fraud liability of allowing compromised bootloaders to digitally sign binding legal contracts would crater the European banking sector within a week. (An important question for system architects: if a user can compile their own identity verification environment, who exactly holds the bag when they use it to sybil attack the central bank's settlement rails?) The state must enforce hardware integrity.
Which brings us to Layer 1, the absolute bottom of the stack, where geopolitical aspirations inevitably hit a wall of proprietary silicon.
How, exactly, does a sovereign European application verify the mathematical integrity of a physical smartphone's motherboard? Because those factory keys are injected by the original equipment manufacturers, the regulators are mathematically forced to route their "sovereign" trust through proprietary attestation APIs. The keys belong to the duopoly. Authenticating Westphalian citizenship credentials via a JSON payload inherently requires pinging Mountain View and Cupertino to validate the math.
The European state cannot spin up an open-source server in Frankfurt to independently verify an Android's Secure Enclave. To prove the device isn't lying, the state infrastructure must hardcode its backend to query the Google Play Integrity API or Apple's App Attest service. If Apple decides to deprecate a specific attestation endpoint, the European state has to update its backend on Apple's schedule. Every single time a European citizen proves their identity to their sovereign government at a High LoA, the transaction requires a real-time cryptographic blessing from an American tech giant.
The regulatory apparatus is confronting an unyielding operational constraint. If you want high-assurance digital identity distributed securely onto consumer mobile devices, you have to rent trust from the duopoly that actually designed, manufactured, and maintains the cryptographic physical supply chain of those devices. The hardware always wins.
Politicians will undoubtedly continue to pass sweeping, ambitious legislation demanding total digital sovereignty, and they will continue to issue press releases declaring victory over American tech hegemony. But the physical layer of the internet has already crystallized. When the ink dries and the production certificates finally rotate, the sovereign state will always find itself standing in line, waiting to pay a geopolitical tax in the form of API calls to Mountain View.