A government endpoint would also be a very spicy target, even if (and that's a big IF) they programmed it correctly and didn't store any verification info outside of RAM and had the internal data references locked down tight.

It might take getting people actual digital keys that are theirs and using those with proper cryptographic processes instead of PII before such a target might end up hardened enough to not be a time bomb waiting to happen.