The unspoken part of this requirement is that websites would have to block users who aren’t connecting via one of these attested, verified, locked down devices.
There is the obvious loophole that using a VPN to a country without these requirements would circumvent it. That’s how kids are already circumventing age restrictions in places like Australia and it’s why the UK has taken an interest in attacking VPNs.
The alternative is what we're getting right now: laws that require verifying ID documents, often in ways that restrict even the notion of maintaining the user's privacy. Attestation might be an "OK" to "good" solution while this is between bad and really bad.
There is no form of digital ID that isn't evil, but anything requiring attestation is super evil.