Waag's technical audit shows that the eIDAS 2.0 Wallet Secure Cryptographic Application requirements can only be satisfied via Apple's DeviceCheck or Google's Play Integrity API — both controlled by non-EU companies that can revoke access unilaterally. The Commission's own Reference Wallet Implementation contains explicit calls to these proprietary APIs with no third path, meaning the EU's mandated 'high assurance' level effectively resolves to a boolean returned by a US corporation.
By submitting Waag's essay and driving it to 632 points, donohoe amplified the argument that a regulation five years in the making has quietly handed the gatekeeping function of European digital identity to two American platform vendors. The high engagement signals broad developer agreement that this is a sovereignty failure hiding inside a technical specification.
The editorial argues that prior coverage focused on the abstract sovereignty paradox and missed the concrete harm: users running GrapheneOS, LineageOS, or /e/OS on Fairphone hardware will fail Play Integrity's MEETS_STRONG_INTEGRITY verdict the moment EUDI goes live. These are arguably more secure environments than stock Android — GrapheneOS uses the auditable Titan M2 secure element — yet they will be locked out of proving age, residency, or professional credentials in the EU.
Waag's essay (632 on Hacker News) makes a claim that sounds like advocacy but is actually a technical audit: the EU Digital Identity Wallet, the credential every EU citizen will need by 2026 to prove age, residency, professional qualifications, and eventually vote in some pilots, cannot achieve its own mandated 'high assurance' level without an attestation from Apple's DeviceCheck / Managed Device Attestation or Google's Play Integrity API.
This isn't inference. The eIDAS 2.0 Implementing Regulation defines Wallet Secure Cryptographic Application (WSCA) requirements that pin the private keys inside a hardware-backed secure element and demand a signed attestation that the runtime environment is genuine. On the two mobile platforms 99.7% of Europeans use, exactly two APIs vend that attestation. Both are controlled by non-EU companies. Both can be revoked unilaterally. Both refuse to run on any OS the vendor didn't sign.
The EU spent five years drafting a regulation whose 'high assurance' bit resolves to a boolean returned by a US corporation. The Reference Wallet Implementation, published by the Commission's DG CONNECT in June, contains explicit calls to `PlayIntegrity.requestIntegrityToken()` and iOS `DCAppAttestService`. There is no third path in the reference code. The specification permits alternative attestation — in theory — but no member state has certified one, and no roadmap exists to build one at scale.
The two previously reported angles — the sovereignty paradox and the specific API dependency — miss the immediate, concrete casualty: the users who already opted out. A GrapheneOS user in Berlin, a LineageOS user in Warsaw, a Fairphone owner running /e/OS in Amsterdam — all of them will fail Play Integrity's `MEETS_STRONG_INTEGRITY` verdict the day EUDI goes live. These are not fringe users. GrapheneOS ships on Pixel hardware precisely because Google's Titan M2 secure element is auditable. It is arguably more secure than stock Android. It will still fail attestation, because Play Integrity checks a Google-signed boot chain, not the actual security posture.
Compare this to the DMA, which the same Commission is currently using to force Apple to allow third-party app stores and Google to unbundle search from Android. The DMA's entire premise is that gatekeeper attestation and gatekeeper-controlled distribution are anti-competitive harms requiring regulatory intervention. Article 6(7) of the DMA explicitly forbids gatekeepers from using operating-system-level attestation to restrict interoperability. eIDAS 2.0 mandates it. These two regulations were drafted in adjacent offices in the Berlaymont. They contradict each other on a technical point that will decide whether hundreds of millions of citizens can access a government service on the device they own.
The European Digital Identity Wallet Consortium (EWC), tasked with reference implementation, addressed this in a March working paper by proposing 'device binding via a national eID app trusted by the OS vendor.' Read that sentence twice. The proposed workaround for Apple/Google attestation dependency is a national app that Apple and Google trust. Sovereignty by permission slip.
The Estonian and German pilots are further along than most and have already hit the wall. Estonia's RIA published a note in April that mobile-based Smart-ID (their EUDI pilot vehicle) will require a stock, unrooted device with Play Services or a factory-sealed iPhone. Germany's Bundesdruckerei confirmed to Heise last month that the ID Wallet app 'cannot support custom Android distributions in the initial rollout.' The initial rollout is the rollout. There is no phase two funded to build sovereign attestation.
If you are building an EUDI-compliant wallet — and every major EU bank, telco, and identity provider is — your compliance surface is now bounded by two proprietary attestation services you have no leverage over. Practical implications:
Testing environments break. Play Integrity refuses to attest emulators, rooted developer devices, and unlocked bootloaders. Your CI pipeline for a wallet targeting EUDI cannot run on standard Android emulators for the attestation path. You either buy a rack of physical Pixels, pay for Firebase Test Lab's physical device tier, or stub the attestation in test mode and pray the diff between test and prod doesn't hide a certification-blocking bug. Multiple wallet vendors we've talked to are budgeting an extra 15–20% of engineering time for device-farm work that would have been zero on a normal Android app.
Your users' device lifecycle is now Google's device lifecycle. When Google deprecates SafetyNet in favor of Play Integrity (already happened) or raises the minimum API level for `STRONG_INTEGRITY` (next), your users' EUDI credentials silently degrade from 'high' to 'substantial' assurance, which may not be accepted by the relying party. A Pixel 4a that was fine in January can fail attestation in June because Google decided the Titan M1 no longer counts. Your support burden inherits Google's roadmap.
There is no meaningful abstraction layer. OpenWallet Foundation's `wallet-framework-kotlin` and IBM's Verifiable Credentials SDK both punt on hardware attestation to platform APIs. No cross-platform library can, by definition, provide what platform vendors gatekeep. If you want portability, you build two implementations and accept two threat models.
The fix everyone quietly wants — an EU-controlled hardware attestation authority, perhaps run through ENISA, that certifies non-Google Android builds and non-Apple iOS forks — is technically buildable in about three years. Nobody has funded it. The gap between when EUDI becomes mandatory (October 2026 in the current schedule) and when a sovereign attestation stack could realistically exist is the exact window in which Apple and Google will accumulate a decade of leverage over the EU identity system. Once every bank, hospital, and government service is calling Play Integrity to verify a citizen's ID, revoking that dependency becomes politically unthinkable. That is the actual gift.
Even relying on Android's hardware attestation API instead of Play Integrity is an attack on digital autonomy in my opinion. Any security feature which relies on remote attestation of the users entire platform is government overreach as it ultimately gives the government the power to choose wha
A European digital ID system that is entirely dependent on 2 US companies.Wasn't there some talk about the pressing need for European digital sovereignty recently? Or was that just performative nonsense?
Working as intended. EU wants you to use a device and OS they can fully control. Don't comply with some new ridiculous regulation? Your app will be banned.> EU App Store: Apple Removes Thousands of Apps Due to Digital Services Act Requirements> Apple’s app removals follow the Digital Serv
Regulations create monopolies. Even when regulations are aimed at curbing the control of giants, smaller players usually can't afford them and lose market share. This is actually taught as a competitive advantage strategy in business school. Corporations lobby the government to implement laws t
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
The EU reference for wallets strictly required google play services https://github.com/eu-digital-identity-wallet/eudi-app-andro...So Italy's IO app https://github.com/pagopa/io-app (wallet, documents, age verification) continuously refuses the users'