Heh, that works for me!

The spec kinda expands on this at https://indieauth.spec.indieweb.org/#oauth-2-0-extension but tl;dr: it removes the need for private stuff and makes the client ID public so you don't have to do client registration (but it also now forces that clients to be addressable — which could be an issue for headless/console apps but that's easy to work around if you do what Mastodon does with dynamic client registation).

This could if the the identity's info provides endpoints similar to OAuth2 — either an authorization and token endpoint or the singular endpoint that'd have all of that info and more (more at https://indieauth.spec.indieweb.org/#indieauth-server-metadata, I'm opting for this because it makes it easy to expose things like documentation about how it works, what kind of scopes are supported and the like).