I have a second question.
Could you make a closed system. Where accounts made to a specific site become accounts owned by that company? Use of the posting and active key are given for daily use. Permission of use can be removed by the company at their digression.
This would be on a second layer maybe. A company providing loyalty rewards or similar.
You could technically yes, there's this thing called posting/active authority that could potentially be used for this or even more "web2" just have people sign up with email+pw to your front-end, which could be resettable and recoverable like the old ways and the "company" is the only one holding the keys, but of course if things go sideways all users could be effected in a breach/hack.