Q:

The attestation is nothing but a hash of the PII + signature of the validator. So if a service provider needs to verify somebody he could just ask another service provider give me the public key of the validator and then just look at the blockchain and verify it himself without paying something in a smart contract.

Example: Service providers could just share all public keys that they have (lets say on a website where all service providers register their known information, public key = validator). And when they then receive a PII from user they could just try to decrypt every attestation on the blockchain and check if the plain text of that decrypted text includes a hash that matches the hash of the PII that he has received from user. Like that service providers would lower their costs massivly and validators provit would decrease massivly.

Isn't that a HUGE problem? Normally in order to get this adopted goverments should join the party as validators. And the whitepaper states on page 13 paragraph 2 "Civic's ecosystem will be designed to incentivice participation of trustworthy IDV providers known as validators, wo may be include financial instiutations, goverments....". How do they want incentive them? The will earn not much if the service providers share there keys and everything is visible on the blockchain.