Maybe we could just specify using Indieauth? Is this possible given the group has said auth is out of scope? This would help convergence