How do the apps bootstrap identity? Do they just use Apple/google (that seems really bad), or do they have you do some verification and input a token into the app somehow?