The documentation clearly outlines that there are multiple signals being analysed. Relying on play integrity alone is definitely not sufficient as you state.
This is necessary because the wallets contain an identity proofing functionality called PID(Person Identification Data). Showing these credentials basically approves you are you. There are high requirements for identity proofing that even pre-date wallets and that makes sense, because the potentially blast radius of identity theft is huge. Historically, these have been secured in smartcards, like eID cards or passports and are not shifting to the smartphone. Verifying the security posture of your device and app is therefore crucial.
Banks actually have high fraud rates today because of weak security mechanisms. If attackers steal your money, the bank will reimburse you. If attackers steal your identity, you are really screwed. Security requirements for banking and identity are simply different.
Preventing credential duplication is a requirement to achieve high level of assurance. One of its purpose is to limit the potential damage that can be done by attacks. If credentials are bound to hardware-bound keys, attackers will always need access to this key store to make any miss-use. If you don't prevent duplication, attackers may extract credentials and miss-use them at a 1000 places simultaneously.
This is due to many parts of the system being spread across multiple IETF RFCs, which happens as OAuth was improved and made more secure over time. Efforts are underway by combining all important parts into OAuth 2.1, otherwise have a look at FAPI 2.0 security profile for high assuance use cases.
First,which DID methods will be successful is a question of time, additional your wallet app could support multiple of these DID methods.
Second, DID and the corresponding keys are supposed to be owned by the user or managed by a platform, any indivdual can make the choice whteher he wants convience of managed keys or full privacy under his own control
Third, you can have a seperate DID for every service and they issue you an login credential for that particular service.
Not necessarily is DID connected to publishing something on a blockchain. First: DID does not make any statements to the underlying infrastructure, this can be a completely decentralized public, permissionless blockchain but also public, permissoned ledger(also decentral but a little less) or the did Methods using a central server as referenced in the w3c mozilla response.
DID for example solves/enables some aspects of the 10 principles of SSI, e.g. portability
Self-Sovereign Identity and DIDs are a very fast moving train. People argue that in the early internet days there was a similar competition between new protocols(compare with DID methods) before we arrive in our todays HTTP(S)-only world. Similarly DID methods will probably consolidate to a handful within few years and DID Core is only a first step to get a minimal common denominator.
Also its questionable if Microsoft&Google and the others are fearing a rapidly evolving ecosystem that they can not jump on as fast and therefore remain sceptic in any case
That sounds like a view from last century. FAANG multinational, sovereign companys and they are interested in money and are not interested in losing their userbase. moreover a lot of these companys have offices in europe as well, so part of these solutions are developed in europe as well. having the HQ in one country is only one aspect of a company
Core mechanisms to prevent Man-in-the-Middle are missing in the article: PublicKey/certificate-Pinning or PKIs. Cryptography is best left to the experts, most of todays javascript developers are probably missing the knowledge to implement or use it in a correct way
Self-Sovereign Identity might replace major parts of the federated identity market within 5 years i expect. even Okta CEO admitted that self-sovereign identity will be the future. the major problem is that the decentralized nature of SSI, will remove the most part and profit of 3rd party tools, as it is easier and cheaper to have direct relations between services and users
comparing all the stocks, seeing that only tesla is in a stable curve near the end, leads me to the following conclusion: Both Tesla and Bitcoin are heavily overpriced!