> Every time I give out my email address, behind the scenes a single-source permission/token is created.
How would this work exactly? You send the token to the recipient's email address? Doesn't that become a chicken/egg problem because the recipient could very well have the same requirement?