This is an elegant, cypherpunk approach to Self-Sovereign Identity (SSI). 
Here is a design breakdown for OmegaID (a working title), covering the
infrastructure, the JSON spec, the in-memory security model, and a seamless
cross-service authentication flow.
1. Infrastructure: The 3+ Node Mesh
Using Cloudflare Tunnels (cloudflared) is perfect for this. You can run 3+
lightweight LXC containers (or even Raspberry Pis) across different physical
locations.
Setup: All 3 nodes run a simple static file server (e.g., Nginx, or even a
lightweight Node/Bun server) serving index.html.
Redundancy: In the Cloudflare Zero Trust dashboard, you bind the single
hostname id.omega-mesh.org to a Tunnel that load-balances across the 3 backend
nodes. If one node drops, Cloudflare routes to the others instantly.
Zero-State: Because the service only serves static HTML/JS and the users hold
their own state (the JSON file), the nodes don't need a synchronized database.
2. The Identity JSON Format
The ID file should be easily parsable but mathematically secure. We can use
ECDSA (P-256 or P-384) which has universal native support in both Browser
WebCrypto and Node.js v15+.
{
  "version": "1.0",
  "omega_id": "omg_1a2b3c4d5e...", 
  "publicKey": {
    "crv": "P-256",
    "ext": true,
    "key_ops": ["verify"],
    "kty": "EC",
    "x": "...",
    "y": "..."
  },
  "encryptionParams": {
    "algorithm": "AES-GCM",
    "salt": "a1b2c3d4...", 
    "iv": "e5f6g7h8...",
    "iterations": 250000,
    "hash": "SHA-256"
  },
  "encryptedPrivateKey": "base64_encoded_ciphertext..."
}

Note: The omega_id could simply be a base58 or hex hash (SHA-256) of the
public key string, serving as their public username.
3. Fulfilling the "Strict Memory Security" Requirement
To ensure the private key is always encrypted in memory, we can design the JS
class so it never stores the plaintext key. It only holds the encrypted JSON
state.
When an action is required, the user provides the passphrase, the class
temporarily derives the AES key, decrypts the private key into a
non-extractable WebCrypto CryptoKey object, performs the signature, and lets
the variables fall out of scope for garbage collection.
4. The Authentication Protocol (OAuth-style, but decentralized)
How do we make it easy for other services to use this without requiring the
user to type their passphrase into a random 3rd-party site? We use a URL
redirect flow, just like OAuth, but handled entirely client-side.
The Request: User clicks "Login with OmegaID" on cool-service.com.
The Redirect: cool-service.com redirects the user to: [https://id.omega-mesh.or
g/?action=auth&challenge=randomNonce123&callback=https://cool-service.com/verif
y](https://id.omega-mesh.org/?action=auth&challenge=randomNonce123&callback=htt
ps://cool-service.com/verify)
The GUI (id.omega-mesh.org):
Parses the URL parameters.
Prompts the user: "cool-service.com is requesting authentication. Drop your ID
file and enter your passphrase."
The local JS decrypts the key, signs the challenge, and re-encrypts/destroys
the plaintext key from memory.
The Return: The GUI redirects the user back: [https://cool-service.com/verify?o
mega_id=omg_1a2b...&signature=base64_sig](https://cool-service.com/verify?omega
_id=omg_1a2b...&signature=base64_sig)...
The Verification: cool-service.com fetches the public key (either passed in
the URL or previously saved during registration) and verifies the signature
against randomNonce123.
5. The "How-To" Snippet (Core Logic)
This snippet is what you would display on the index.html page. It uses purely
native crypto.subtle so it works in both V8 browsers and Node.js without npm
packages.
/ OmegaID Core - Works in Browser & Node.js
class OmegaID {
  constructor(jsonPayload) {
    this.data = jsonPayload;
  }

  // 1. Derive AES key from passphrase using PBKDF2
  static async deriveKey(passphrase, saltHex, iterations) {
    const enc = new TextEncoder();
    const keyMaterial = await crypto.subtle.importKey(
      "raw", enc.encode(passphrase), { name: "PBKDF2" }, false, ["deriveBits",
"deriveKey"]
    );
    
    // Hex to Uint8Array helper assumed here for brevity
    const salt = hexToBytes(saltHex);
    
    return await crypto.subtle.deriveKey(
      { name: "PBKDF2", salt: salt, iterations: iterations, hash: "SHA-256" },
      keyMaterial,
      { name: "AES-GCM", length: 256 },
      false, // non-extractable!
      ["encrypt", "decrypt"]
    );
  }

  // 2. Sign data (Strict memory: passphrase required per action)
  async sign(dataString, passphrase) {
    // A. Derive the AES key
    const aesKey = await OmegaID.deriveKey(
      passphrase, 
      this.data.encryptionParams.salt, 
      this.data.encryptionParams.iterations
    );

    // B. Decrypt the private key JWK
    const iv = hexToBytes(this.data.encryptionParams.iv);
    const ciphertext = base64ToBytes(this.data.encryptedPrivateKey);
    const decryptedBuffer = await crypto.subtle.decrypt({ name: "AES-GCM", iv
}, aesKey, ciphertext);
    
    // C. Import as a NON-EXTRACTABLE signing key
    const jwk = JSON.parse(new TextDecoder().decode(decryptedBuffer));
    const signingKey = await crypto.subtle.importKey(
      "jwk", jwk, { name: "ECDSA", namedCurve: "P-256" }, 
      false, // Crucial: JS engine refuses to export this key once imported
      ["sign"]
    );

    // D. Sign the challenge
    const enc = new TextEncoder();
    const signature = await crypto.subtle.sign(
      { name: "ECDSA", hash: { name: "SHA-256" } },
      signingKey,
      enc.encode(dataString)
    );

    // signingKey falls out of scope, raw JWK was garbage collected
    return bytesToBase64(new Uint8Array(signature));
  }
}

Why this design hits all your marks:
Redundant & Lightweight: Cloudflare tunnel handling static files means it
essentially can't go down and costs nothing to run.
True SSI: You aren't storing user passwords or keys. If id.omega-mesh.org is
compromised, there is zero user data to steal.
Developer Experience: Any service can integrate this just by generating a
random string (challenge) and verifying an ECDSA signature. No heavy OAuth
SDKs required.
V8/Node Compatibility: Relying strictly on WebCrypto means your snippets will
run natively in browser DevTools, Deno, Bun, and Node, which fits perfectly
with minimalist JS ecosystems.