what do you need a refresh token for if you are getting an npub once
how do you trust the ID provider