In short, your browser asks the identity provider to sign a certificate proving that you are [email protected]. The browser will then use that certificate to authenticate you on the site. The site can check this certificate by getting the pubkey from the identity provider. You are never associated with the site you are authenticating against (except on very low traffic identity providers)