IndieAuth plugin is fine for me. I have it installed and active anyway since it’s part of the suggested IndieWeb plugin collection for WordPress. In fact I feel more uneasy with auth functions crammed into other plugins where I don’t even expect them to be. Feels wrong to have such functions all over the place.