That reminds me of my rant over some recent IRS free-filing stuff. They were basically telling users to go ahead and trust a third-party service named id.me with all their sensitive personal identifying information.

FFS guys, at the bare minimum you should have white-labeled that behind a domain like id.irs.gov! Not just to avoid mis-educating users into terrible security habits, but also to avoid giving some Montenegro DNS folks the ability to intercept or man-in-the-middle all the information.