this is why I am building a communications software that has no concept of accounts, devices can connect and keys are generated on device and blind to relaying/directing server/network. people can only connect directly with other people/devices. there is no concept of lists of people/devices to connect to, you need to know someone/have access to the device to connect.

no accounts to compromise. no passwords to remember. end point devices control their connectivity. no vpn needed to connect, no intermediary to see all traffic and peer traffic is specifically what is needed/allowed/requested, not a wide open network connection/accounts to be compromised

The bill doesn't define "accounts", so it's entirely possible local users that a human signs into would count.

The saving grace is that obviously they have no idea what a Linux distribution is, and only the Attorney General can bring action, so there isn't much risk of the AG suing Debian.