Stripe Identity is used to verify passports, it supports 33 countries (mostly NA and EU) right now. A salted hash of the country code and passport number is published on chain which allows only one instance per passport.

As far as a state level attack, it's possible. A complete solution to Sybil resistance is not simple.

The passport verification service is at https://coinpassport.net if you would like more information.