Fair point...but worth the effort? Also, what if the bank signs your ip-address and user-agent-header as part of their payload back to the RP? That's like mis

Fair point...but worth the effort? Also, what if the bank signs your ip-address and user-agent-header as part of their payload back to the RP? That's like mission-impossible / hack into Langely level of effort to get into pornhub, no?