It'd be difficult to hold the states as being non-compliant if they can't access a database that isn't available.

It's kind of like the doctor's creed: Do no harm. Make sure that the credential itself can be accommodated for what its current uses are.