What do you mean by government suppression? The government suppressing entities, or you as the authorizing individual?
EU has eIDAS, and Germany has an existing working system. A certified publisher and you with your NFC phone can confirm your age above x without disclosing any other information about your identity. It runs with sophisticated cryptographic negotiation between the three parties. For you as an end user, obviously the government already knows of your existence beforehand and can serve as an authorative entity. The two other parties can then verify their validity to each other through the mutually trusted entity without revealing unnecessary information to any of the parties. Practically, the requesting entity must be certified by the state to confirm their validity and reasonable necessity of what kind of data they plan to request, and the user use their moile phone NFC and an app to read their identity document, and give explicit consent to specific data sharing.
I'm not too familiar with the specifics of what the state can see in this system. It seemed plausible to me that they may not even see that you're authenticating with a specific party or that and what you're sharing. Cryptography ftw.

5 with reasonable acceptance and use, even advocacy, for up to 1. I don't see a difference between 4 and 5, though.
Reviews should be the norm. Even for simple changes, a simple code change should be simple to review and approve, too. At the same time, some formatting changes or small or minimal changes with high confidence can be pushed to main without review - that'd be just wasted time and effort on the reviewer's side. High urgency can also warrant an immediate push to main, or live hotfixing on prod if possible, with a corresponding PR still open.