If they're already building a central identity provider then something built upon Web/EU standards would work much much better. Tried and tested for decades, AS

If they're already building a central identity provider then something built upon Web/EU standards would work much much better. Tried and tested for decades, ASiC-E (or S/MIME if you really really want) works great.