Comment by ForHackernews

> Google already recognizes that fact, by setting a different value in the "sub" field of the claim it returns

Then Google is doing the right thing. It's incumbent on the relying party to enforce its own authorization policies based on the information the authorization server provides.

Google says, "here's bob@example.net <id=n49d0x>", oh now "here's bob@example.net <id=pv82x1d>"

Google can't save consumers from their own negligence.