SSO Without Giving the Server Your Keys

Single sign-on is a solved problem. You redirect to an identity provider, it tells you who the person...