What web auth system doesn't rely on a user having a secure inbox? It is vastly different from signing in with an IdP, since I can use my email address regardless of who my mail provider is.