Self-custody, control and identity: How regulators got it wrong