Am I the only one who thinks Oath is over-complicated bordering to security through obscurity and vendor lock-in ?

The protocol could be as simple as this (using password)

    app => auth-server (can user:pass login to app?)
    auth-server => app (no | yes)

Or using "crypto":

    app => auth-server (can user login to app ?)
    auth-server => app (only if user can solve challange=XXXX with answer=YYYY)

Asking for capabilities:

    app => auth-server (what permissions do user have on app ?)
    auth-server => app (user has access to: X, Y, Z)