Just did a test, and I think we may be able to implement FedCM in Mastodon. It seems that you can actually create Doorkeeper Applications with a client_id that's a URL, rather than having it generate a unique client_id for you.
However, where it fails is that you don't get a unique client_id, so registering the same client again fails with a duplicate record error (maybe this is intentional?)
I guess FedCM client_id's don't have a client_secret at all to use…
