they could also just let them run their own keycloak instance and use that as the provider for the realm so customers can more easily debug it themselves.

it doesnt need much maintenance, so it doesnt really get easier than that.

Think it would be using brokering, the instance of Keycloak would be an external identity provider. Each customer would have their own instance of Keycloak that could then be configured to broker their choice of identity provider. I think this might be achievable at the realm level in a smaller scale deployment, i.e., using a separate realm for each customer but still chaining them back to the central realm through brokering, rather than spawning off new instances of Keycloak. Just a thought..