The escrow case is the one I'd build from, because it's the normal case anywhere the parties deliberately don't share an identity provider — a homeowner, a lender, and a contractor never will. Keeping authority in your own system of record and binding each credential to the specific request with a content digest is the same shape we use for verification stamps on a house record: the stamp is bound to a hash of the exact claim it signed, so it can't be replayed onto a different claim and it lapses the moment the content changes. Authority is who may speak to a domain; the binding is what stops a valid signature from being reused where it doesn't belong.