Seems like it isn't all the protocol? A lot of it is the and the current tools. If you have a hardcore dev who knows auth they can implement to spec and be safe/simple-ish.