Actually, there's a W3C WG that works (worked?) on a protocol called WebID, that uses public keys to authenticate users, and servers are not identity providers

Actually, there's a W3C WG that works (worked?) on a protocol called WebID, that uses public keys to authenticate users, and servers are not identity providers but just serving profile information. http://www.w3.org/2005/Incubator/webid/spec/#authentication-sequence http://www.w3.org/2005/Incubator/webid/spec/#authentication-...