Phone numbers work fine but we're missing solid cryptographic verification systems on top of them.

Why are registered businesses not verifiable? Or at least banks and government departments? Why can't phones hold an ID in their cloud profiles so switching numbers let's your friends auto-uodate to you?

We could be doing so much better (with the goal of making it practical to whitelist only operate).