But do we need some kind of SSO layer with DID verification? All I need to prove my identity anywhere, technically, is my private+public keypair. As long as I hold on to this keypair, distribute it between apps/computers, back it up, I could log in anywhere on a federated platform and use it.

I hope we're going to see key-based decentralized identity on ActivityPub at some point... Having accounts tied to instances is just not very robust or scalable.