I was talking to someone about how the Google Beyond Corp system worked, and at least initially the user had to walk over to help desk with verifiable ID to get a cert issued