I'd agree that implementers only want to integrate one security
services layer. But some implementers want their security services
layer and identity stack to be as cleanly separated as possible so a
tight binding between the two is not desirable. TLS only provides
certificate-based identity today, a mechanism that is very different
from other user identity services because it does not require the TLS
stack to perform a user identity network lookup in the middle of the
TLS handshake. Doing that means the TLS stack suddenly has to
communicate problems talking to the identity lookup service through
the TLS stack and back to the application.
