Aside from the fact that it was stored in a public database, there’s no need to store photos of the IDs at all. The account can just be marked as verified and move on.

Also I doubt that measure would keep a man out if he really wanted to join…

I mean, the graphics card issue sounds like a Windows virus to me, so probably would be fixed with a Linux install.

I support moving off GH but

There is no way to send in a patch, raise an issue, or anything without an account there

Currently this is the case everywhere? With the exception of projects that take email patches, currently all the options are centralised/not federated, and even if e.g. Forgejo finished adding ActivityPub integration you’d still need an account on some Forgejo instance to contribute. Same for email patches; they still require having an email address. If it’s specifically about giving MS your data, sure, although iirc the only data they actually require is an email address. You can use duckduckgo’s duck addresses to get one that’s relatively anonymous (i.e. can be deanonymised by duckduckgo but I doubt anyone’s conspiring that hard to deanonymise a random github user).