> if it might not be worth isolating the parts of the protocol/flow that actually requires a service (i.e. protocol-aware server in the loop) from those that don't, so that you could still get limited authentication/identity-tagging if your "provider" is your personal domain where you're just hosting static site.

I'm having a dense moment, so I can't quite grasp what the person asking wants to achieve, or what flow they envision. Can you help by spelling it out?