Comment by VyseofArcadia

This seems like exactly the sort of work the US Digital Service should take on.

Would still need an audit to make sure sites are actually using the shared auth and not rolling their own.