I can agree to this: this allows a user to not have to trust that the company running the application set up password authentication properly.

But still: I just can't get worked up about this at all. I'd rather see pgp get implemented in browsers before this.