What about the risks/security concerns for websites ACCEPTING OpenID? If someone logs in and commits credit card fraud with their OpenID, now I have to find their OpenID provider via law enforcement and have them subpoena'd vs having all the information in one place. The upside is there may be other activity the OpenID provider can help identify when subpoena'd.