You don&#x27;t trust your email provider? Today your email provider is already <i>implicitly</i> your underlying IdP for almost every website you visit that uses that email (if it has a &quot;Forgot Password&quot; button that sends you an email, your email provider is your IdP). All Persona attempts to do is make that <i>implicit</i> assumption an <i>explicit</i> part of that email&#x27;s identity, and even tries to make it somewhat more secure than sending random tokens via often insecure&#x2F;semi-secure SMTP channels, as most &quot;Forgot Password&quot; systems do.<p>Ultimately yes, if you want to sign in to a website with your email address you typically have to trust your email provider. This is true on the web almost universally with or without Persona.<p>Why is any IdP required by Persona? Identity protection and reuse across browsers are two big reasons. If I want to say that I am&#x2F;use the email &quot;wm@example.com&quot;, Persona tries to verify that I actually have access to that email (can sign in to my email provider, or can do the classic click a random token link in an email cycle if my email provider isn&#x27;t supported).