This seems like the main blocker. Why is that required? In theory all the site needs is a public key to verify against.