this reminds me of when oauth was developed in the early 2000s - something that needs to be built cross-industry as an open standard and have buy in. the larger question is how will large retailers and aggregators - Amazon, airlines, etc react and handle an era where they can't own the final user experience.