> there's a lot of trust in that model No, there isn't. It's basically an OAuth login flow. The spec is publicly documented, anyone can register applications a

> there's a lot of trust in that model No, there isn't. It's basically an OAuth login flow. The spec is publicly documented, anyone can register applications and check if the government is responding as desired, both by correctly requesting auth for the correct scopes in the government-hosted auth page, and by checking that the data returned from the gov matches what the spec promises.