I found this particular passage of the protocol summary intriguing: "the server must verify two signatures of 'scope' which includes every detail of the transaction e.g. SWIFT, amount, currency, account number or Bitcoin address. Entire transaction is signed on both devices (usually desktop + mobile)."
The ability to subdivide authorization is one of my favorite aspects of Tarsnap, although there the delineations are both more flexible and under the control of the client instead of the server.
https://github.com/sakurity/securelogin
The ability to subdivide authorization is one of my favorite aspects of Tarsnap, although there the delineations are both more flexible and under the control of the client instead of the server.