Don't forget a transparency log visible to the person, where it would be possible to audit who requested what assertions and what authentications were made, etc. This may even be public information (some statistics on what companies request what assertions) - to put pressure on not requesting needless crap.