The way Reddit did this was by just giving out a token, that could be done in the same way here on lemmy, I think that would solve the issue.
Now it’s true that you will be redirected to the site (here lemmy) but that’s the same on all services, as a user one needs to check the host name and certificate of the site they’re directed to.