I’m in Finland. We have “strong identification services” for logging on government websites, some companies that need to handle personal data, and like.

During the Plague, the people who run the system floated the possibility of providing “has this person been vaccinated? Yes/no” as a type of identification field. And another example that was floated at the same time was “is this person over 18 years old? Yes/no”. Point is, this ID system offers information on need to know basis and the user always sees exactly what information is shared.

So, actually, the most devilish thing to do would be to provide just that information and nothing else. Some weird company needs to know if the user is an adult? Well, just tell them that, and nothing else. If they whine about it, just tell them this system provides them exactly the information they asked for. Also it’s the official government service. No reason whatsoever to doubt its validity! Wait, are they still whining? Well maybe they’re not trustworthy and we shouldn’t provide them this service.