If a node chose not to present a ZKPOP then it would just get dumped into the "other" bucket, and using it would be no different to how things work today. You don't get the upgrade to anti-sybil protection but it wouldn't be any worse than now. It has to be optional because we're talking about a protocol extension. For it to become "mandatory" would require users to all choose to run wallet apps that required the new feature, but wallet apps are a competitive market and they're all open source. If you didn't want to request this data you would never have to.
How much anti-sybil is this really? If I understand you right, the root trust here is in government CAs. I'm not sure I would trust them more than corporations to keep keys safe. Probably a lot less, actually.