wouldn't a simple system of signatures certified by a certificate authority (like for the web) solve this problem in a much more direct way?
For example, we could have had an identity verification protocol, bound to our browsers, that would have logged us in websites. We would not have needed FB oauth for ex. But it was not prioritized, and now that the Web has been taken over by closed garden, individual companies have very little incentive to contribute to these general-benefits protocols.
Token can be seen a way to incentivize adoption of these general-benefits protocols
If they throw out a signature they don't like, the system works perfectly fine - it's treated like any other untrusted product.
No one should trust a system that has a "don't trust this, it's bad" flag, it should always be "trust this, it's clean".
Courts. Laws. Governments.