«By the way, neither identity protection nor reuse across browsers does not strictly require IdP.»<p>Technically correct, but it makes it a <i>lot</i> easier at a practical level, especially for non-technical users. Users have trouble remembering passwords, key management is seemingly beyond most users. So too are systems like the &quot;web of trust&quot; model of key identification much to complicated (and onerous and time consuming) for the average user.<p>IdP is the best bet we have of at least somewhat decentralizing trust decisions in a way that is user friendly.<p>«With Persona you trust a very specific third party - some email provider. You trust it to behave and you trust it to serve and stay so for as long as you need your identity.»<p>This is not a requirement of Persona. You can use any email you like with Persona and it&#x27;s not a platform requirement that user accounts in a system be one-to-one with email addresses. It&#x27;s certainly possible a site using Persona can very easily tie multiple identifying emails to your account. It may not be likely that a lot of sites would do it, as one email, one person is a rather generally accepted identity world at the moment, but it&#x27;s also not far fetched that the replacement for the &quot;Forgot Password&quot; button in a hypothetical universe where Persona is the only option is a &quot;Associate another email address to your account&quot; button.<p>«However, if - for example - you have an identity asserted by a keypair»<p>But what good is this assertion? How do I as an application provider trust your assertion? At bare face value an &quot;identity asserted by a keypair&quot; is a fingerprint, a boring hexadecimal hash. I don&#x27;t know very many people that associate themselves as &quot;fe:02:aa:45:c3:d0&quot;. You could self-assert an email address or a name&#x2F;pseudonym, fine, but as an application provider I can&#x27;t make any assumptions about the contents of that email address or name&#x2F;pseudonym and the only trust I have in it is &quot;your word&quot;. You could use web of trust assertions, but again we get into the bootstrapping issue of &quot;web of trust is hard&quot; and &quot;users don&#x27;t want to have to do it&quot;.<p>The same goes for all of your hypothetical key management: yes, you <i>can</i> manage a key on your own cognizance in any number of ways. Ultimately, most people just don&#x27;t <i>want</i> to.<p>On the flipside, Persona too has more options in this space for IdP management and key management than maybe you&#x27;ve given it thought: There&#x27;s a Mailinator-based IdP that will sign any key request from Persona for pseudonymous identities (while even maintaining the application provider assertion that the email is valid and accessible to that user). There&#x27;s the ability to do IdP delegation from a domain, using a file on my website to choose which IdP I trust right now, which can easily change over time. (Static HTTP sites on custom domains are cheap as free, including Github Pages as one option.) There are more ideas out there and you can reasonably approximate whatever half-finished idea you have for your own key management system with Persona given a little bit of time and elbow grease.