SSO Without Giving the Server Your Keys

Single sign-on is a solved problem. You redirect to an identity provider, it tells you who the person is, you mint a session. Every framework has a library for it. Then you try it on an app that encry...