How would you use technology to design a foolproof or safe identity document?

Your problem is foolproof and safe don't necessarily go together. Safe generally means a level of complexity to ensure it is not easily hacked. Foolproof normally means simplicity so that it is more difficult to socially engineer, which is generally difficult to achieve with complexity. My best answer here would be a 3 or even 4FA system that relies on a terminal such as a computer, a mobile device such as a smartphone and an identity card such as a drivers license or passport. The fourth factor could be biometric but the tech isn't quite there yet. Sticking to your criteria that biometric factor would probably would have to be fingerprint, facial or voice recognition. The terminal would have to have a VPN to the identity server and an external link to a 3rd party certification company. Minimum login complexity, network and OS security are assumed. The mobile device should ideally use a token system that works functionally similar to an RSA token. This avoids the potential of phone porting from SMS authentication. SMS authentication is also viable but it would probably take the solution beyond foolproof. Device and SIM encryption is assumed. The ID card should have a chip embedded in it that can be read by a proprietary reader device attached as a peripheral to the computer. Sufficient and proprietary encryption is assumed. The device would ask you log in using your login and password. It would then push a token to your mobile mobile device or rely on a predefined algorithm and ask you to enter it. You would then swipe your ID card and if all combinations successfully verified you would be allowed access.