From what I read (very <i>very</i> briefly), the spec is similar to what OpenID was, in that anyone who runs a web server can become an authentication provider. Ideally there&#x27;d be a distributed-hash-table type web-of-trust so its semi-centralized (i.e. somewhat like PGP or BGP routing tables where you peer with people you trust).<p>Now that 1st party browser certificates are available so you get that Trusty-Green-Lock(tm) on all browsers, geeks can theoretically run their own identity service based on some sort of combination of these technologies. (Ideally with the long term outcome solving the &quot;Why Johnny can&#x27;t have Crypto&quot; problem, maybe using a cell phone app as an RSA SecurID type dongle.) This also has the benefit of letting you authenticate against your bud John&#x27;s Identity Server, rather than Go-fuck-yourself-Fred&#x27;s (you&#x27;d need token negotiation in there somehow though).<p>Someone smarter than me (DJB where are you?) should piece this together, release it as open source for the end-user, and fund it via expensive Exchange module integration.