Self hosting Mealie could be a great option to take things into your own hands.

To be more clear I was more focused on the not wanting a car that needs software updates part of the argument, less so the means of delivery. Obviously, having an always on connection absolutely sucks and I’d personally be super down with just pushing an update via a USB drive or whatever like you can a BIOS update. But a lot of manufacturers have it set up so that you have to either pay a dealership to plug in the USB for some arbitrary reason, or demand the always on connection to do it. In a utopia of software development where there are no critical bugs, we would all prefer a car that doesn’t need updates. I didn’t mean to imply that I was arguing in favor of remote connection by manufacturers, and it’s absolutely my bad in not wording it properly.

On the flip side: if a car stereo has a known firmware issue causing problems with say Bluetooth connection, I DO want the manufacturer to actually provide an easy means of fixing/updating the borked software. Better that the system was properly tested and feature complete to begin with- but I’m not delusional enough to believe we can truly have nice things.

Possibly dumb question: why not use an Authentik outpost with a reverse proxy to enforce SSO? It wouldn’t be “baked in” so to speak, but it would be fully OIDC and as long as you’re just running it through a web browser. Biggest downside is you’d need 2 logins (one for the outpost and one for the app). I’d assume the sso is specifically for the extra security though, so that shouldn’t be a problem outside of it being a little hassle.