Fwiw the SSO angle is what gets me, one federated identity provider means one compromised path exposes every agency hanging off it.