Mozilla "Persona" beta release

Namely, Persona requires relying on some party for verification. As described elsewhere in the thread, this could be the party owning the website, but defaults to Mozilla's own servers. For that to work, Mozilla needs to send the email themselves -- they can't trust the user's browser to send the email.

How the identity verifier actually goes about verifying identities is beyond the abstraction barrier that the browser cares about. Either the JS implementation or the built-in server will generate a request to the appropriate verifier, saying, "Please give me a signed message I can pass back to this website." If the verifier is Mozilla, this results in Mozilla sending an email, but the browser doesn't need to know that. If the verifier is some ISP or corporate site or something, maybe they can do out-of-band verification.

(And, in any case, JS in the browser has no ability to send emails.)