Even with multi-resolver fallback (0.0.3), the SSO page still depends on at least ONE HTTP indexer being available + honest. The fully decentralized version queries Nostr relays directly for the user's DID-metadata event.

This sits entirely on top of JSS#414 — once that lands, the SSO page can use the same logic in-browser:

1. Subscribe to a configured set of public relays (relay.damus.io, nos.lol)
2. REQ for the user's did:nostr metadata event kind, authored by their pubkey
3. Verify the signature, parse the embedded DID doc, extract alsoKnownAs

Why this matters

Removes the last centralization point. The pubkey-to-WebID binding is verifiable from the Schnorr signature on the relay event alone — no indexer required.

Acceptance

• Relay fallback inserted between 0.0.3's resolver list and the "give up" terminal state
• Default relay set configurable via ?relays= URL param (comma-separated)
• Browser-side signature verification (existing nostr-tools or similar)
• Replaceable-event ordering: pick highest created_at across responding relays

Refs

• JSS#414 — server-side relay-based resolver
• 0.0.3 — multi-resolver HTTP fallback this builds on top of