I've been trying to figure out how zero-knowledge stuff would work in practice for age verification, where "when issued" (or extremely coarse, like what year), "to whom", and "where it's used" are hidden from everyone except the individual holding the proof (since that's the gold standard, and the only one worth accepting). I get that ZK techniques work, and reveal "nothing". That's useful. But if they reveal nothing…
That's where trusted computing comes in. Your proof proves two claims. That the person proving their age is over 18, and that they're using a device and software that hasn't been tampered with. That software requires human presence at every age check. ZKPs for age assurance are trading off privacy at the expense of software malleability. Note that this has nothing to do with open source; it's perfectly fine to releas…
The released code can do all of that, and then nothing still assures me that they didn't implement just a POST to their partner and called it ZKP and pointed at google's repo.