The Estonian ID-Card[1] that allows all of this is also pretty neat. Basically it is usually* a smart card that has your x502 government signed certificates stored on it.

And because its a normal x502 certificate you can use Mutual TLS to authenticate every ID-Card holder / Estonian citizen by just adding those 3 lines to your nginx server config block[2]

  ssl_client_certificate /etc/ssl/certs/EID_Bundle.pem;
  ssl_verify_client on;
  ssl_verify_depth 2

(Adding a OCSP check is also highly recommended)

Due to the ease of integration, the same ID-Card is also used to implement login for a lot of online websites and is also used as an Loyalty card in stores. It is also possible to use the ID-Card for SSH login[3] because it's just a standard smart card.

* There is also an Mobile-ID that stores the x502 cert on you phone SIM card and a Smart-ID iPhone/Android app that require custom API-s and paying for the access.

[1]: https://en.wikipedia.org/wiki/Estonian_identity_card

[2]: https://www.id.ee/wp-content/uploads/2021/05/2104-ubuntu-ngi...

[3]: https://ubuntu.com/server/docs/security-smart-cards-ssh