We can do better with zero-knowledge-proof-based schemes, which also allow securely decoupling issuance/certification from online verification.

E.g. https://linc.cnil.fr/en/demonstration-privacy-preserving-age...