there must be some challenge-response type NFC systems on the market

There are. Hotels use them for door key cards so they can’t be cloned.

They could stick it in Azure or AWS or something.

They could just spin up a no-name instance that isn’t associated with them to get it through federation, though. It still doesn’t make sense to scrape.

It does a number on my stomach. I had grilled cheese and tomato soup for dinner. I knew what I was doing. I’m feeling it, though.