It needs to happen at the application level. You can phish for someone's open ID login just as easily as you can their Yahoo login, right? Just make it transparent to the user, build it into the browser.