Sure and that is how we do SSO (though SameSite=Strict can interfere with that method too).

But if that's the recommended approach, why are they providing a standard route to do SSO via an iframe with the Storage Access API? Does that API have any other valid uses that aren't tracking or SSO related?