@TheLuBu i think we might be hitting some limitation on n8n architecture, read this:
And to truly trustworthy identity i think you need to setup a redirect to external auth endpoint like azure, and to basically control that. (you can just add a basic auth in your form so that only limited people know the password, also if any user would be able to create an auth for another user that still would require a password or some amount of information that is somewhat safe, but you are correct on that one!)