I like the idea of maybe pursuing a extension-first plan for the next attempt at BrowserID. Some thoughts:<p>- There have been Persona extensions before for at least Firefox. It will probably be important to learn from them, even if I&#x27;m sure hardly anyone tried to use them.<p>- Edge&#x27;s extension support can&#x27;t come soon enough.<p>- The issue I could see with extensions is it is harder to trust the verified email addresses in &quot;fallback&quot; situations. The chicken and egg bootstrap problem here still seems to indicate that you still want some sort of trusted notary. Maybe a simpler fallback provider that is just a state-less &quot;passwordless&quot; (passwordless.net) proxy that would be easy to clone and some way to create an actively maintained whitelist of trustworthy clones?<p>- While we&#x27;re looking at &quot;extension-first&quot;, maybe find ways to make use of the browser&#x27;s SSL client certificate infrastructure? Obviously, if you could build a good UX for bootstrapping (email-only) client certificates you could finally help people make good use of such an old, underutilized browser feature.