This stuff is based on plain old identity federation. SAML protocol using SAML assertions. The problem is that they're outsourcing identity provision - ref. ".

This stuff is based on plain old identity federation. SAML protocol using SAML assertions. The problem is that they're outsourcing identity provision - ref. "...such as banks, governments, healthcare organizations, and others..." in the linked article. The article also (correctly) states that "The credential exchange will be designed to transmit credential information securely without knowing users’ actual identities." This is neat, for sure, but isn't always required (how would a health care provider be useful if they didn't know who you are), and is only half of what they should be doing. So the relying party shouldn't always need know who the user actually is, but (much more importantly) the identity provider should never need to know where the user is conducting his or her affairs. As an example: You're laid off at work, and need to claim benefits. You have a mortgage, and because you feel you can get a new job before you run out of savings that service the mortgage, you don't want your bank to know that you're been laid off. But guess what, your bank is your identity provider, and will know that you've logged into the jobless benefits site. So the bank flies your mortgage into the side of the mountain. No survivors, call off the search. Providing this kind of asynchronous privacy (where, at the user's discretion, the relying party cannot determine who the user is, and the identity provider cannot determine who the relying party is) is not difficult. U-Prove is tech from Microsoft (acquired from Credentica) that does it, and is open-source.