There are 2 issues and I’d probably be sold already:
IndieAuth plugin is fine for me. I have it installed and active anyway since it’s part of the suggested IndieWeb plugin collection for WordPress. In fact I feel more uneasy with auth functions crammed into other plugins where I don’t even expect them to be. Feels wrong to have such functions all over the place.