SteamCommunity.com has a buggy OpenID Provider. Specifically, as we can see from Jonathon's question:
Assertion endpoint info:
ClaimedIdentifier: http://steamcommunity.com/openid/id/76561197999083260
ProviderLocalIdentifier: http://steamcommunity.com/openid/id/76561197999083260
ProviderEndpoint: https://steamcommunity.com/openid/login
OpenID version: 2.0
Service Type URIs:
Discovered endpoint info:
ClaimedIdentifier: http://specs.openid.net/auth/2.0/identifier_select
ProviderLocalIdentifier: http://specs.openid.net/auth/2.0/identifier_select
ProviderEndpoint: https://steamcommunity.com/openid/login
OpenID version: 2.0
Service Type URIs: http://specs.openid.net/auth/2.0/server
The Provider is issuing identifiers to their users that are OP Identifiers instead of Claimed Identifiers. Any relying party that accepts Steam OpenIDs are buggy and likely have alarming security holes since they are not verifying assertions properly.
I have reported this to Steam.
Technical details
The identifiers they are issuing have XRDS documents that think they can be both OP Identifiers and Claimed Identifiers:
<?xml version="1.0" encoding="UTF-8"?>
<xrds:XRDS xmlns:xrds="xri://$xrds" xmlns="xri://$xrd*($v*2.0)">
<XRD>
<Service priority="0">
<Type>http://specs.openid.net/auth/2.0/server</Type>
<URI>https://steamcommunity.com/openid/login</URI>
</Service>
<Service priority="10">
<Type>http://specs.openid.net/auth/2.0/signon</Type>
<URI>https://steamcommunity.com/openid/login</URI>
</Service>
</XRD>
</xrds:XRDS>
But this is specifically broken by the OpenID 2.0 spec, section 7.3.2.2:
Once the Relying Party has obtained an XRDS document, it MUST first search the document (following the rules described in [XRI_Resolution_2.0]) for an OP Identifier Element. If none is found, the RP will search for a Claimed Identifier Element.
and by section 11.2:
If the Claimed Identifier is included in the assertion, it MUST have been discovered by the Relying Party and the information in the assertion MUST be present in the discovered information. The Claimed Identifier MUST NOT be an OP Identifier.