tl;dr: The EU's open-source age-verification project has confirmed that hardware-bound attestation (via Android TEE, StrongBox, or Apple Secure Enclave) is a mandatory requirement, effectively locking out Linux, custom Android ROMs, and self-compiled apps from native support. Compounding this, Proof of Age providers will only issue credentials to apps on an EU-maintained compliance list, meaning open source code doesn't guarantee a community build can access the actual service. Critics argue this undermines the "open" nature of the system by tying access to approved hardware, OSes, and vendors.