Once email providers start providing their own Identity Providers then the security falls entirely on them.
For instance, once GMail starts being its own authenticator, my two-factor authentication there will kick in.
Thoughts?