@mike @johnonolan Great episode - thanks!

John, I'm not sure private messages are sufficient(ly private) for your authentication needs. Have you looked at stuff like IndieLogin and WebFinger as ways of abstracting logins to a common user@domain identity?

See this page for some of the considerations: https://indieweb.org/WebFinger and my own collection of info https://wiki.underlap.org/en/link-relations