IDs would have to be reissued with a public/private key model you can use to sign your requests.

> the person at the keyboard, is the same person as that ID identifies

This won't be possible to verify - you could lend your ID out to bots but that would come at the risk of being detected and blanket banned from the internet.