Not OP but I assume it's the security-related "no dependencies on external services or leaking data" requirement.
Even if you'd make an exception for Tailscale, that'd require settonv up and exposing an OIDC provider under a public domain with TLS, which comes with its own complexities.
Even if you'd make an exception for Tailscale, that'd require settonv up and exposing an OIDC provider under a public domain with TLS, which comes with its own complexities.