Its not like govt agencies care about security either. Its just "compliance" bs. Most european eID stuff works like that.