Comment by brendn

I'm curious about that issue, too. Here's a brainstorm:

- An independent Identity Provider (IdP) uses some means of identification for the user (two-factor, iris scan, whatever)

- The IdP provides an anonymized email address to each site that the user logs into.

I'll have to read the spec a bit more to see if that's possible...