I can't believe you are still arguing this is impossible.

Just because you don't understand any of what you have been told does not mean "stories" are changing. All you need to know is that a working national ID authentication service has been available and widely used in Iceland for years and if it was vulnerable to botnets lots of Icelandic bank accounts would be emptied by now.

To mention that the verification is national ID based, physical key based or SMS based are all working simplifications of how it works and obviously not in depth technical descriptions of all use cases.