though it sounds like they could add KYC stuff and restore access for US citizens

I suspect so, I just got an email yesterday from Anthropic on their privacy policy update and they added:

As part of our measures to keep our services safe and secure we may ask you to verify your age or identity, and we've described what we collect and how.

So yeah, ID verification is coming unfortunately. I wonder how that's going to work for team/business/enterprise plans? Is every individual corporate user going to have to submit their ID? How do they handle staying in compliance with the law with credential sharing that can happen within the company from the same IP address?