The unspoken part of this requirement is that websites would have to block users who aren’t connecting via one of these attested, verified, locked down devices.
There is the obvious loophole that using a VPN to a country without these requirements would circumvent it. That’s how kids are already circumventing age restrictions in places like Australia and it’s why the UK has taken an interest in attacking VPNs.
The alternative is what we're getting right now: laws that require verifying ID documents, often in ways that restrict even the notion of maintaining the user's privacy. Attestation might be an "OK" to "good" solution while this is between bad and really bad.
There is no form of digital ID that isn't evil, but anything requiring attestation is super evil.
Old hardware will have to be grandfathered. Old cars don't track us and that has created a market for old cars.
Hardware age attestation will be a long timeframe project. The current work should be towards standards that can get us there.
Finally, anonymity didn't exist for my grandparents. It won't exist for my grandchildren.
Your grandparents could walk to the next town over and give themselves a different name and nobody would ever know who they were. They could get a job, be paid in cash, and deposit that money in a bank account with no KYC. They could drop a letter in a public mailbox without a return address, or put up posters at night, or make phone calls from public telephones. Nobody would know who did it, and there would be no surveillance footage to review after the fact, no digital footprint to trace. They could write a letter to their local newspaper to be printed with a fake name, or publish a book or story or magazine under an assumed identity. There were no ALPRs, no automated facial recognition, no built-in vehicle telematics, no drones, no smartphones to track anyone’s movement, no doorbell cameras on every block, no video tapes, no serial numbers hidden in the printouts from copy machines, no DNA analysis, no databases instantly searchable with the click of a button.
Feel free to make a value judgement about whether what we have now is better or worse than the past, if you want, but don’t invent history to rationalise it. The internet did not invent anonymity. It used to be the default.
Unfortunately it's so much easier for lawmakers to slap down a law that says "you must verify IDs right now if you want to continue to exist" with no requirement, and often not even support for, privacy preserving ways to make this happen. The laws are happening now. The chance of reform to align with a privacy-preserving option once the laws are implemented is slim to none.