Disappointed that the first solution isn't: Let somebody else do it. I know this doesn't apply to banking, etc but 99% of the websites that "require" me to create an account and log in don't need to store primary credentials for me. Please pick a secure implementation of oAuth2 and let people store their credentials wherever the hell they want to. I'm bored of getting hits from "Have I been pwned?"
This requires your users to trust whichever OAuth providers you decide to integrate with. Sometimes, the set of "trusted OAuth providers" for your users is {}. What then? > 99% of the websites that "require" me to create an account and log in don't need to store primary credentials for me Why are you giving them valuable credentials? Give them a throw-away password (password managers are great for this).
A hybrid between the two (common OAuth-style endpoints and any OpenID endpoint) is the best solution for everybody.