The Gmail-style "tap to sign in" flow.
Register multiple users with different usernames, then sign in
with a single click - the browser shows the account picker and
the server identifies you from the assertion's userHandle.
(no username needed - browser picks the account)