The third party company shouldn't ever need to see the IDs, either. Same issue.

When governments do things the wrong way around, like mandating age control before they have a method for doing that in a secure manner, what's a company to do?