So, Sony uses Yoti — and it’s using a callback method so users can complete the Yoti verification flow by scanning QR code on their phone, similar to how OAuth2 allows? But if your phone has Graphene, the flow won’t work and instead triggers notification to local authority that someone tried multiple times to “bypass” it or something? Basically forwarding their own sever errors, due to incompatible clients, to the authorities?

Is that the right understanding?