While I do appreciate the efforts of the foundation, a true privacy by design foundation should be promoting the PbD principles in general instead of simply building a decentralized identity app.
Ask them what their main basis for processing personal data under GDPR is when they collect user data. Also ask about their retention management. How can they ensure personal data is only retained so long as they have a basis for processing?
Privacy lawyer here...you 100% cannot waive your GDPR rights as a condition of the service. In fact your consent can not be a precondition of using the service. Most adtech companies out there will try to rely on legitimate interest as a basis for processing.