> 3) In the keynote, the demo of logging into to other services like Spotify appears to just be stealing the auth tokens from the laptop and shipping them to the R1 device. Not a good sign.

It just looks like OAuth to me?