How much hacking would it take to run an authentication server for multiple separate Web sites, such that the users and sites can authenticate each other while trusting only the authentication server?
This sounds like Kerberized Web to me, but I'm not positive about that.