I’ve answered this previously here.

https://news.ycombinator.com/item?id=24238783

In a nutshell it’s to handle federated identities.