A system comprising: one or more hardware platforms implementing a hosted authentication service to provide authentication services for relying parties (202, 430), the hosted authentication service and the relying parties (202, 430) being separate parties, the hosted authentication service registering a relying party (202, 430) by sharing a key with the relying party (202, 430), the hosted authentication service comprising an administration portal through which a relying party administrator configures the hosted authentication service to provide authentication services on behalf of the relying party (202, 430); a first program code component provided by the hosted authentication service is inserted into an application hosted by the relying party (202, 430), the first program code component causing a client device accessing the application to be redirected to the hosted authentication service for user-authentication and other authentication-related functions including registering one or more new authenticators and deregistering one or more authenticators of a user's client device; and the hosted authentication service, based on a plurality of different authentication-related events occurring between the client device and the hosted authentication service, transmitting a plurality of assertions directly to the relying party (202, 430) thereby bypassing the client device, each assertion of the plurality of assertions specifying one different authentication-related event occurring between the client device and the hosted authentication service, each assertion of the plurality of assertions including at least one indication, wherein a first assertion indicates that the user has registered a new authenticator with an associated security strength/level, a second assertion indicates that the user has deregistered an authenticator, and a third assertion indicates that the user has authenticated with the authentication service using an authenticator, wherein the relying party validates each one of the plurality of assertions using the key. one or more hardware platforms implementing a hosted authentication service to provide authentication services for relying parties (202, 430), the hosted authentication service and the relying parties (202, 430) being separate parties, the hosted authentication service registering a relying party (202, 430) by sharing a key with the relying party (202, 430), the hosted authentication service comprising an administration portal through which a relying party administrator configures the hosted authentication service to provide authentication services on behalf of the relying party (202, 430); a first program code component provided by the hosted authentication service is inserted into an application hosted by the relying party (202, 430), the first program code component causing a client device accessing the application to be redirected to the hosted authentication service for user-authentication and other authentication-related functions including registering one or more new authenticators and deregistering one or more authenticators of a user's client device; and the hosted authentication service, based on a plurality of different authentication-related events occurring between the client device and the hosted authentication service, transmitting a plurality of assertions directly to the relying party (202, 430) thereby bypassing the client device, each assertion of the plurality of assertions specifying one different authentication-related event occurring between the client device and the hosted authentication service, each assertion of the plurality of assertions including at least one indication, wherein a first assertion indicates that the user has registered a new authenticator with an associated security strength/level, a second assertion indicates that the user has deregistered an authenticator, and a third assertion indicates that the user has authenticated with the authentication service using an authenticator, wherein the relying party validates each one of the plurality of assertions using the key.