OpenID todo list (edit)

• Add support for D-H key exchange
• Tidy up processor code
• Look at how authentication logic is abstracted
• Tidy up keymanager
• Move D-H processing to association routine
• Tidy up bigmath library
• Revoke all old keys periodically
• Alternate data store

Version 2.0 changes

• Association attempts may fail
• Verify openid.op_endpoint
• Investigate YARIS/XRI stuff
• Realm instead of trust_root

Provider requirements

• Check with user it's ok to continue
• Show as much information about the server as possible (associate/dumb mode, trust root, return url)
• Allow the user to select which (if any) of the sreg details are returned
• Ability to remember both login and sreg details for each server (based on trust root?)
• List of authorised sites (options to revoke auth)
• List of recent sites
• Anti-phishing message on the main page