ÂÂÂ Also, as a minor point, SAML is an OASIS and ITU-T standard (Rec X.1141), not ISO.
There have been continued conversations (and one workshop) with some of the players in the browser space that are active in the W3C privacy WG that's proposing various browser changes.
The general status right now is that the main FedCM draft proposal is just an outright break of both SAML and OpenID Connect, with (IMHO) no obvious "tweak" possible to fix it.
A proposal has been formulated for discussion for a lighter-weight consent-oriented proposal in place of the full FedCM work that would be 99% compatible with the existing SSO protocols (a small _javascript_ addition to the SP/RP end).
There is some sense that having an official-ish statement from OASIS or at least the SSTC that "hey, SAML is an ISO standard and your proposal breaks it in a way that isn't just easily fixable, a different approach is needed for a number of years if we need to effect a transition away from existing protocols".
Is that something we could consider?
We don't know who else we can come up with that the W3C or this WG might hear.
-- Scott