Key thing that needs to be addressed is to somehow be able to auth without providing the same pubkey to every service to prevent trivial links between accounts.

Should be easy to do, but important to do from early on with something like Nostr login to allow aliasing!