This is not about perfection, as is, unless I missing something, your suggested solution does not solve the problem. There are numerous ways for a system to au

This is not about perfection, as is, unless I missing something, your suggested solution does not solve the problem. There are numerous ways for a system to authenticate a user without the endpoint requesting the authentication knowing who the user is — or the system verifying the user knowing what endpoint system is requesting the authentication; only the user knows both who they are and the endpoint they want access to.