I think something people are missing here is that outsourcing your SSO isn't just about whether it's technically easier to do so, or having the competence to run it. A significant factor is also being able to say on contracts with clients that you use a reputable provider for SSO, who are then on the hook for dealing with all the documentation around precisely how they do that, and how they ensure key material is secured.
In the case of 1Password its a bit more interesting, since they presumably already have all that sorted because that is literally the product that they're selling, but in most cases it's easier to say "no one in the organisation has access to keys" rather than "no one has access, except Bob, because he runs the SSO server, but we really trust him you know".
In the case of 1Password its a bit more interesting, since they presumably already have all that sorted because that is literally the product that they're selling, but in most cases it's easier to say "no one in the organisation has access to keys" rather than "no one has access, except Bob, because he runs the SSO server, but we really trust him you know".