The European Union’s open-source age-verification project has drawn criticism after a maintainer confirmed that hardware-bound attestation is a mandatory architectural requirement. This decision raises concerns regarding Linux, custom Android ROMs, and independently compiled applications. To prevent credentials from being copied or reused, the project relies on keys stored in protected hardware like Android TEE, Strong Box, or Apple’s Secure Enclave.

Critics argue this approach endangers the system by making it dependent on a small number of approved devices and operating systems. Furthermore, a governance limitation exists: Proof of Age providers are expected to issue credentials only to applications included in a list of compliant apps maintained by the European Commission. This means publishing source code does not guarantee a community-built version can use the service.

While Linux is not explicitly banned, the current architecture lacks a native Linux wallet. The controversy centers on whether an EU-funded, open-source identity system can remain open when access depends on approved applications, supported security hardware, and the policies of credential providers. A dedicated security review and threat model is expected soon.