mozilla/fxa-auth-server — pull request #703 by rfk (2014-05-05 06:00:25+00:00)
Title: Allow signing certificates as secondary authority over the verified email address

Just a little thought experiment, not expecting anyone to merge this :-)

What if we allowed the client to ask for persona-style fallback certificates? That is, certificates for the user's actual verified email address, but signed by the fxa server as secondary identity authority. It's a pretty minimal change from an API point of view. It might terrify @warner though...

This is, in a way, the dual of the https://verifier.accounts.firefox.com API which allows you to customize the list of trusted secondaries - it lets you ask https://api.accounts.firefox.com to act as a secondary authority.

Why would anyone want to do this? Dunno really, just pondering potential synergies that might stem from our shiny new database full of verified emails...