Basically, you don't need to trust an OpenID provider: the user does.
Let's compare, from the strict perspective of authentication, passwords with OpenID.
- Password: User: “hey, server, it's me! You know it's me because no one else knows the magic word
correcthorsebatterystaple
, which I told you when I created the account.”
- OpenID: User: “hey, server, it's me! You know it's me because
johndoeblog.com/openid
says it's me, and I told you to trust johndoeblog.com/openid
when it says it's me when I created the account.”
In both cases, as a server, you rely on the user's willingness and ability to choose a reliable authentication method. With passwords, the user must choose a password that nobody else knows. With OpenID, the user must choose an OpenID endpoint that nobody else can use.
For authentication purposes, there is no reason, as a server operator, to prefer one OpenID provider to another. You may (or may not) prefer to recommend OpenID providers who you know to be reliable, but you do not need to trust the OpenID provider in any way to authenticate the user.
Both cases rely equally on the user's cooperation to ensure that the user who paid is the one who uses the service. A password-authenticated user can share their password; an OpenID-authenticated user can allow the use of their OpenID endpoint.
All this is because you only care about the user's identity as account #1234 on your server. It would of course be completely different if you wanted to know that the owner of account #1234 is known as Joe Bloggs to the government of Syldavia: then you would need to trust the OpenID provider to provide you with Joe Bloggs's real name.
One minor reason to trust an OpenID provider is to offload the work of limiting account creation rates: if you know that Myriad has measures in place to restrict the account creation rate, and you only accept Myriad OpenID accounts, then this automatically restricts the account creation rate for your service. This doesn't apply to you: given that you're running a for-pay service, account creation rate restriction is built in.