So the identity provider could just generate this unchangable ID and let the user link any number of aliases to it, right?