Was this mostly copied from browserid?  It all looks sensible, just curious if it's already battle-tested.