>Proof of identity in theory can solve the problem but at the cost of privacy.

All current implementations: yes. I do think there are some privacy preserving solutions, but they're obviously imperfect. But assuming you have a central authority that can validate and sign valid government identification, it seems like some sort of ZK scheme could allow one to verify that they have a valid government issued ID, but without disclosing which one it is.

I still don't love the idea, but it sure seems better than everything else I've seen proposed.

From what I've seen no such solution guarantees privacy to the user if the signing body (or the government) and the website collude to deanonymize the user.