tantekwith relmeauth, the idea was that any service that consumed relmeauth would (could) also keep a cache of *confirmed* rel=me identities, and then let you check some subset of those (more than 2 obv) as a method of "recovering" your domain-based account
