It’s easy to say “just ignore the law” when you’re a nobody on the internet. But also, this isn’t much bowing. More like slightly inclining your head to do the bare minimum.

They’re debating about the best way to make sure that data doesn’t end up where it shouldn’t. They’re not implementing some systemd-level verification requirements. They’re literally just offering a central-ish place to handle storing and securing that data. If anything, this should be preferable to having different implementations with different levels of security standards.

And it’s delusional to think that Linux will collectively be able to evade this requirement, unless the law as a whole ends up overturned (which I very much hope it does). You wanna get pissed at someone for sucking fascist dick, get pissed at the lawmakers passing this crap.

A data field isn’t the hill to fight that battle on. If someone goes and actually implements mandatory verification, I’ll be right there with you, (pitch-)fork ready and ready to burn bridges, but this isn’t it.