I clicked the lost password link on a site handling legal documents the other day and they sent me a plaintext copy of my password via unencrypted email.

There may be issues with a central identity provider, but given the wide range of horrible choices implemented by so many different websites I think the assumption that keeping identity between you and the site owner is a better choice than trusting a central provider is true only in a limited number of cases.

If I hadn't hit the lost password link I never would have known that they keep an unencrypted copy of my password. Finding one trustworthy central provider at least protects you from unknowingly trusting a large number of incompetent providers.