The kernel could authenticate the user before starting it.

How does it do that?

There are many ways from passkeys to SAML. Though for complex methods we may want a dedicated services outside the kernel.

How does that service get launched with the privilege to switch to any user?

	▲	charcircuit an hour ago \| parent [-]
		The kernel can start a process with any user it wants. The user doesn't have to switch during the process's life.