@simon But hmm, the more I think about this, the less comfortable I get. When you do an OpenID Connect “sign in with X”, the ID Token you get has both an "email" and a "sub" field, and the real unique key is the combination of the ID Provider and the "sub" value, which in the case of Google survives an email change. Some details here: https://www.tbray.org/ongoing/When/201x/2013/04/04/ID-Tokens from when I was in the Google ID group.