> a government API could provide the simple assertion

Yes, it could, but we don't have that, do we? They launched the ban without implementing a zero-knowledge proof scheme as you described. In a very short amount of time the providers will have associated millions of people's accounts to their biometric information and/or their government issued IDs.