This is just an Internet user license scheme. Unless World ID open sources all their code to verification they can't be trusted. "Trust then verify" does not apply when leakage of personal bio-metrics tied to personal identity is at stake.
A better alternative would allow:
* The end-user to be the single holder of the unique private bio-metric fingerprint ID
* The end-user to generate derived public IDs based on the private bio-metric ID. This should be a one-way transformation.
* The service provider(SP) to hold the public ID in their user account records
* the end-user to provide proof to the SP that the public ID is derived from the private bio-metric ID. This would be the authentication process.
It should not allow:
* any means for any private or public institution to connect personal identity with any public IDs unless the end-user chooses to do so.
