As far as I understand OIDC and OAuth, this means that any tokens (the passwords) have to go through Eartho, no? So while this may help reduce sensing PII to the SP you are trying to authenticate towards, you are now effectively doing what decades of IT security teaching told you not to do: giving 3rd parties your password -- only that now it's in transparent and the end user isn't aware of it.
