I heard from the dev that they are implementing DigiD to do the authentication for the distribution. With DigiD they only get your BSN, nothing more. Sounds good to me...
First of all,
there is no way they are ever going to integrate DigID! The Dev is a private person and in no way related to any government entity. So if they are implementing DigID into the registration, they most certainly are going to get arrested!
Once they start registering DigID's they can completely steal one's identity (up to ordering new passports and claiming tax returns!).
So let me absolutely clear on this!
The moment I see DigID asked on the claim page I will immediately turn the DEV in to the authorities! I've got his Identity and address, so this will not be to hard. I think he nows that as well, so you can be sure, he won't!
If the developer is planning to use this data for fraudulent purposes, openly asking for ID would be the dumbest way to get it. One single developer is easy to trace and will be in jail as soon as he tries to use someone else's identity. Therefore I don't believe the developer has malicious intentions.
However... if someone hacks into the ID database, or intercepts the (non-SSL!) upload without leaving any traces, both the dev and the people who uploaded their ID will be in deep shit.