You can't just buy one on the dark web because the credential is tied to a private key — you'd need the actual device or key, not just the token.

A government-issued cryptographic credential lets you prove you're a real adult citizen without revealing your identity. It eliminates bots and foreign actors, protects children, and preserves privacy — because the government only gets involved once at enrollment, and platforms never see who you are, just a yes/no proof.

(I'm not an expert, so if anyone has input please correct)

EDIT:

The one-time government verification moment is a major privacy chokepoint. Who runs it? How is that database secured? History is not encouraging here -- government identity databases get breached, misused, or quietly expanded in scope. "The government only gets involved once" is doing a lot of work