> unless third party providers get to become, by explicit user permission and setup, A first class citizen I'm not keen on handing my identity over to a third-

> unless third party providers get to become, by explicit user permission and setup, A first class citizen I'm not keen on handing my identity over to a third-party to manage. And I share the concerns of the commenter up-thread that TLA agencies have fingers in this pie; if they don't, then they're not doing their jobs. I had a go at implementing oAuth and self-hosting it; but part of the problem with (some of) these open protocols is that people with much more time on their hands than you, and with membership on the specification committees, start messing with the protocols and making them much more complicated. That happened to CalDAV - I wrote a CalDAV server, but it was obsolete as soon as it was finished, because the specs had already moved on.