this doesn't quite solve the problem, though. this prevents a user from getting locked out of their own email by an attacker, but doesn't do anything to prevent

this doesn't quite solve the problem, though. this prevents a user from getting locked out of their own email by an attacker, but doesn't do anything to prevent an attacker from gaining access in the first place -- the root of trust, the password, is just as fragile as it was before (potentially more fragile, because the added friction discourages changing the password on a fixed schedule). i would, however, be interested if such a service (somehow) used a public/private identity key model, rather than a username/password model. a fully password-less service, with key registration done in-person. implemented correctly, this would be a dramatic improvement on the status quo in terms of email account security. the fundamental flaws with email as a secure communication channel still remain; these would still make me hesitate. ultimately, i'd reluctantly pay for it because using the web forces me to maintain a secure email account and this would be the easiest reliable way to do so. (side question: imagine you discover your password was compromised late friday night. do you need to wait until monday to re-secure your account?)