Having used ID.me before, I thought their email was a phishing attempt at first, before I looked into the situation and found that it was legit. Government services should never ask users to provide personal information to third parties which lack .gov TLDs; it's very problematic from the perspective of a cautious user.