Initial test of the "Sign in with Apple" API: * It's more or less based on OAuth + OIDC * Their documentation is missing a lot of key info to use it right now, I had to guess at a lot of things * The `sub` claim includes some sort of unique user identifier, not an email

weirdnesses: * Their token endpoint requires setting a User-Agent header, otherwise responds with an HTML error * Client secrets are a signed JWT using ECDSA + SHA256 * An email address isn't returned even when requesting the `email` scope