Your loophole argument collapses because open-source isn't a service, it's infrastructure. Tor isn't a platform that can "dodge" anything—there's no central operator to demand verification from. Any kid with a VPN already bypasses age gates on every closed platform, so the moral panic about forking is empty. If a commercial site forks code and runs it as a business, it's not exempt; the law targets the operator, not the code. Forcing open-source to verify would mean killing anonymous access for journalists, abuse survivors, and dissidents. That harm is real and concrete, not hypothetical. You can't regulate a protocol into compliance without turning it into surveillance.