How to do a Google proof

There is a very large number of Google accounts, both @gmail.com and a huge number of other domains via Google Apps. Google provides a free high-quality authentication service based on OpenID Connect. The result is an ID Token, which asserts that:
- an account was authenticated in a browser or android app by accounts.google.com
- the account has a particular email address and also a large numeric ID which in theory can survive changes in email address
- there’s a particular “audience” value (which identifies a keybase app registered at the Google dev console, and you can be confident that’s what was displayed to the user when they agreed to generate the ID token)
- there’s an issue time and expiry time
- An ID Token is a JWT, a JSON object base64’ed and signed by Google with their public key, which anyone can retrieve (it rolls over every day)

I’d think that a non-expired ID Token issued to the Keybase audience, and signed with the user’s private key, would be a satisfactory proof for Keybase purposes.
- To do this in the keybase.io web app would be easy if the private key is available in the browser. But for many of us it's not.
- To do this in an Android app, if the key is stored on the device, would be easy.
- To do this in an iOS device, if the key is there, should be possible but I’m fuzzy on the details.
- To do this in the command line would be tricky because OpenID Connect is based on OAuth 2 which uses browser-redirect semantics. However, would it be satisfactory to generate the ID Token, download it to the user’s computer, sign it with the command line client, then update the signed version back to keybase?

Start by reviewing the proposed Google OpenID Connect flow for the keybase.io web app, Android app, iOS device, and command-line client. Determine whether the ID Token can be safely signed and submitted across those entry points, and document a decided implementation scope and completion criteria.

Written by the indexing model from the issue text.