And then remove the existence of cookies altogether, I infer. Since only a unique identifier is necessary, with all other session data and preferences being stored on the server.

I notice in a comment further up that Apple has two separate IDs. One for advertising and one for tracking users of a vendor's applications. Should this browser ID system have two separate IDs, one for securely identifying a user and another for advertising? The secure ID would have to be unique per website, otherwise phishing schemes just became ridiculously easy.