Any reason not to call it "identity" instead of "service"? Isn't this always going to be passed an instance of IdentityVsomething?

Will this work across versions of Keystone? I don't know.