Why would you exclude the obvious implementation from consideration? You missed one point though: you have to be superuser to change the flag.

This is literally already the law in California and Illinois.

How is it impossible? The OS already advertises which codecs and cyphers it accepts. Is adding an age flag a bridge too far?

And arbitrarily changed? Can a regular user arbitrarily change the super user password?

What complexity do you imagine here? Put it behind ACLs or some other permissions scheme. I could almost believe you’re being sarcastic or trolling.