Yeah, some way of authorizing senders would be nice. I don't think this will ever happen, but one can dream. When registering on a website, the "validate email

Yeah, some way of authorizing senders would be nice. I don't think this will ever happen, but one can dream. When registering on a website, the "validate email address" step would then be an auth flow, instead of "we send you an email and you click that link". And there's no need to authorize the website to send you messages, since successfully completing the flow would be good enough verification. Could be based on OIDC or IndieAuth. Forgot password for that website? Enter email, get redirected to your auth flow, verify. (Or just do something like "Login with Google", but with this thing instead). The website abused the auth flow and requested permissions to send you messages, and now you're getting spam from them? Click some button that says "I don't want to receive messages from [NAME] anymore", where "[NAME]" is whatever name associated to that token, and it revokes that token. Getting a weird message from some unknown site? Same as above, plus you would know who sold your token without needing email aliases or anything. > * Maybe for people who don't have a valid token to send to someone, there can be a way of requesting a token, maybe the sender's name, public key/address, a short sentence for justifciation and if the recipient agrees, then the sender can send the rest of the mail. It won't be long before you start getting request from Mr. "Buy MyProduct" and Ms. "Visit MyWebsite".