this seems a little over-complicated, why not just use a catch-all? If website example.com requires my email, I provide them with the email example.com_xxxx@js

this seems a little over-complicated, why not just use a catch-all? If website example.com requires my email, I provide them with the email example.com_xxxx@jszym.com where xxxx is a randomly-generated 4 (or more) character code. I save the email and password in my password manager. This way, I can blackhole compromised emails, and also prevent spear-phishing by checking the 4+ letter code. I don't wish to be overly negative, and this is a problem-space ripe for a solution, but this service can vanish tomorrow and take with it all the sites I've subscribed to. I was thinking just today that it'd be cool for the next generation of email to require a sort of OAuth login to get permissions to send you automated emails. You can then just revoke the API access for a rogue/compromised service.