[closeparen]

How would a service come into possession of a Macaroon good for another service? I could see getting a macaroon for a username/password/2FA in a frontend context, but how does it solve backend service authentication?