Sure, but I have 2 counterpoints:

1. There’s no reason the 3rd party app needs to be proprietary. This is starting to get technical, but my understanding is that you get a cert from the requester, and it’s the combination of that with the state issued magic cert that’s used for validation. The 3rd party app is essentially just a calculator. It doesn’t need any certs of its own

2. That’s an implementation detail. My argument is that it’s the implementation that’s the real cause for concern here, not the idea