My understanding from friends is One Login is a glorified bastion host that reliant services & parties are obligated to blindly trust, making it a giant SPOF; that alone would be terrifying at national scale, but then: this:

“Whistleblowers have told ITV News that One Login is failing to meet the mandatory, minimum government cybersecurity standards, ‘Secure by Design’ and the ‘Cyber Assessment Framework’”

https://www.itv.com/news/2025-12-18/whistleblowers-raise-extreme-concern-about-security-of-governments-digital-id