The league/oauth2-client team used to have many "official" providers
but decided that ensuring they were maintained to League standards was
extremely difficult. Hence, the oauth2-client team reduced the list to
a few very popular packages (Google, Github, Facebook, etc) and choose
to keep a list of 3rd party packages.
I personally do not want us to get back into that situation and
attaching the League name to a package that is maintained by someone
who is a not League member is a slippery slope for quality.
Is there a middle ground somewhere that would make it easier to handle
situations like this?