The example they give in TFA is having the user scan a QR code, presumably from a mobile device.

But that's not a specification

I think they are jumping ahead but it does seem like a logical conclusion. Would tie in nicely with the online ID verification stuff popping up everywhere.