Now I'm wondering if it'd be feasible to extend OpenWebAuth magic sign-on (developed by the Friendica and Hubzilla creator Mike Macgirvin in the Friendica fork-fork-forks Osada and Zap in 2018; now available on Hubzilla, (streams) and Forte client-side and server-side and on Friendica only client-side) to something that works similarly.

• I log into hub.netzgemeinde.eu, and I choose @jupiter_rowland@hub.netzgemeinde.eu as my active channel (the latter is something Hubzilla-specific).
• I go to sh.itjust.works.
• sh.itjust.works recognises me as being logged in as @jupiter_rowland@hub.netzgemeinde.eu and e.g. grants me some particular permissions.

Maybe this could be extended to:

• sh.itjust.works knows that @jupiter_rowland@hub.netzgemeinde.eu = @JupiterRowland@sh.itjust.works, automatically logs me in as @JupiterRowland@sh.itjust.works and gives me full local user permissions (as opposed to only guest permissions which are what OpenWebAuth is there for right now).