Comment by lxgr

I share that concern somewhat, but I think your point stands even better without suspecting some shadowy attestation cabal.

The US has thousands of banks, and nobody tells them how to authenticate their customers – they just all end up doing the same few horrible things, since nobody ever gets fired for doing what all their peers do (and maybe a little bit more to be sure).