While True, isn't browserID piggybacking on this? Using your email as the "persona"? An accidental benefit would be any service that implanted this would be automatically two-factored for users who have a two-factor system enabled. I like the thought of that.