I was toying with an idea/protocol where:

1. You add a TXT/CNAME that points to a trusted "authentication provider".

2. When you try and login to a website that supports the protocol, it checks the DNS record and redirects you to your provider.

3. You then "prove" that you own the domain to the provider - how this is done would be specific to each provider, but one possible method could be by providing a signed message that can be verified vs. a public key stored in a DNS record.

4. The provider redirects you back to the original website with a token.

5. Finally the original website consumes this token by sending it in a request to the provider. The response contains the domain as confirmation of the user's identity.

This approach removes the need for self-hosting as users can point and setup their names with third party providers.

Users can also trivially switch to a different/self-hosted provider by changing the CNAME.

Communities could also allow direct registration by hosting their own provider instance and pointing a wildcard subdomain at it: (i.e. *.users.ycombinator.com).

Users could then sign up to said provider using traditional email/password and claim a single subdomain: (i.e. tlonny.users.ycombinator.com)

Thoughts?