I brokered my sign-in through Keycloak, and broke my own owner check
Putting a self-hosted identity server in front of LinkedIn deleted 240 lines of workaround and turned PKCE back on. It also handed out a privilege escalation — because the claim never changed, but the trust underneath it did.