@… I can think of ways you might do it by getting people to set a DNS CNAME, for example, so they own the domain *but* authentication is controlled by a service. In theory, this allows ownership because you can replace it with a competitor.
AP is probably harder, but I don't think it's impossible, based on my cursory reading of the …