Just load the state's public key into the verification apps, have the identity QR code be signed with the state's private key and you're done. You can now verify identities without the state ever being aware of verifications taking place.

No need for blockchain when a central authority is issuing identity documents anyway.

If you want to delegate signing authority just do something like SSL certs.