> A slightly less overloaded summary might be "users must trust their identity provider" And every CA in the world. And trust that the identity provider is al

> A slightly less overloaded summary might be "users must trust their identity provider" And every CA in the world. And trust that the identity provider is always competent (i.e., that the .well-known/browserid file is never compromised). Which isn't really true of usernames & passwords--at least that way a mistake at my mail provider doesn't automatically expose my banking account to risk.