The only good identifier is a private one. Email, usernames, etc. They should all be changeable. You don't know what laws come unto function, which events occur, does a person change gender and now need a new social security number, did a person use a business email account for all their private stuff. Usernames change as we fancy, and the whole uniqueness around usernames are a little bit silly as well.

A private id is probably just the best, whether it is a UUID, or another type of sufficiently collision resistant id, kept away from the user for the most part.

Let said person have an email or username, and let other people tag or friend them, but only use said username/email when doing the initial connection. Base said connections off of, the private id