What you describe is called QES (Qualified Electronic Signature) and is still widely used to validate identities.

Unfortunately it is not enough to prove an identity (you could be using the credit card of your traveling uncle) and regulation requires for it to be combined with another proof.

I see a lot of people associating identity verification with evil intent (advertising, tracking).

I work in this domain and the reality is a lot less interesting: identity verification companies do this and only this, under strict scrutiny both from their customers and from the regulators.

We are not where we want to be from a privacy standpoint but the industry is making progress and the usage of identity data is strictly regulated.

As someone looking in from the outside: what regulations govern this type of work?