I prefer the split approach. I use SSO on the inside of my home network and for hyperscalers and things like Tailscale. At least partly so I could enforce hardw

I prefer the split approach. I use SSO on the inside of my home network and for hyperscalers and things like Tailscale. At least partly so I could enforce hardware auth when not supported or sane to implement natively. Everyone else gets a custom email address. It’s a nice in-between.