Yes, I see the redirect issue and the confusion it would introduce. Signing a piece of transient data makes sense, I will look into that.
Re: ASWebAuthenticationSession, I have already done some basic testing with it, the implementation is simple and it seems to work well, including with SSO. I don’t think SSO bouncing between sites would be any different than in the Safari app. It would be nice to at least test this. If there are any issues, switching back to launching the Safari app instead would be straightforward.