Is there a problem relating to phishing as well? For instance if the user is redirected to a fake login page. The username/password entered would then compromise the accounts the user has at all sites that he or she has tied to that OpenID.