I just want a real federated identity protocol with public key distribution and access delegation through signed certificates. Do discoverability through DNS. Tie identities to providers via their hostnames (user@provider seems to work fine for email).