Note that there's no such thing as an EU age verification app. Every country will have their own app, with different architectures and security / privacy* trade-offs. E.g. the Dutch app doesn't have the keys. Instead all signing is done by a government server (with an HSM, but who cares). Websites with age checks require that government signature. * = or lack of it, usually