> They just have to check any login attempts against that ledger - easy enough.

So like CT logs, but several orders of magnitude bigger? I thought centralized TLS revocation lists failed due to scale. How will this differ?