When you 'sign up' you would just provide you public key to the website (upload or url). Then when you were presented with a login, the browser would be sent a data set to sign with your private key and send back to the server you are trying to access (which would then verify with you public key).
My main frustration right now is that, aside from Bouncy Castle, all the libraries I've looked at to do cryptography seem to just be partially implemented wrappers around GnuPG.
If all I had to do was grab their public key, I could then do everything behind the scenes (even creating groups so that some people can see some photos and others can't).
Anyway, this is very simple to do. You first create a server that can authenticate you just for itself over the web. You send it your id, it sends a random string. You sign it and send it a random string of your own. Server signs your random string and sends it back. You both know you are authentic, server leaves a signed cookie at your end. Now this server can act as an openid server too. You give random web-app your openid residing on this server... random web app asks this server. It confirms or denies and life is good.