I can agree to this: this allows a user to not have to trust that the company running the application set up password authentication properly. But still: I jus

I can agree to this: this allows a user to not have to trust that the company running the application set up password authentication properly. But still: I just can't get worked up about this at all. I'd rather see pgp get implemented in browsers before this.