The Case Against ID Cards: A Principled Approach