German eIDAS wallet could effectively require an Apple or Google account, it has been reported

What the government doc actually says

It has been reported that Germany’s wallet implementation under eIDAS will tie mobile device security checks to the use of platform keystores and a vulnerability-management system. The Federal Ministry’s wallet development documentation outlines a Mobile Device Vulnerability Management (MDVM) concept: wallets use an authentication means bound to cryptographic keys in a hardware keystore (HKS), the system continuously monitors known vulnerabilities in the HKS and OS, and if a device is judged vulnerable at a certain attack potential the wallet prevents use of those keys. The aim is straightforward: stop attackers from extracting or misusing keys and keep high-assurance IDs from being cloned or mispresented.

Why people are saying “Apple/Google”

Why does that matter to Apple and Google? Because modern mobile keystores, attestation services and vulnerability signals are usually provided by the platform vendors — think Google’s Play Integrity/Attestation or Apple’s Secure Enclave and device attestation — and those services often require an active vendor account or services stack on the device. Critics on Hacker News and elsewhere allege that, because the MDVM depends on platform-level attestation and OS vulnerability telemetry, users without vendor accounts or with devices not enrolled in vendor services could be prevented from using their wallet. Put bluntly: the security rules that protect the ID might also gate access through Big Tech.

Stakes, friction and politics

That’s the emotional core: security versus accessibility. Policymakers can point to strong reasons for MDVM — real-world mobile exploits have been discovered repeatedly — but the trade-off is real. Could citizens be locked out of a government ID because they refuse to create an Apple or Google account, run a custom ROM, or own a legacy device? That’s the worry. It’s a classic EU dilemma: tighten the screws for higher assurance, and you risk digital exclusion or vendor lock-in. Not great optics when the continent is trying to diversify its tech supply chain.

What’s next

For now, the documentation describes a technical direction; it has been reported that critics and privacy advocates are asking for clearer guarantees and alternative attestation paths that don’t force reliance on a single vendor ecosystem. Officials will need to explain how they’ll balance resilience and inclusion — or expect more sleepless nights and pitched debates in the weeks to come.

Sources: opencode.de, Hacker News