It just feels to me like the zanzibar mechanism was built with the idea that the authorizing party hosts all the data.