Comment by seanmonstar

> So your email provider doesn't know where you're logging in.

This is already the case. For browsers that use the shim, the certificate is stored in localStorage on the login.persona.org domain, and then given to the website you're trying to login to.