[Kwpolska]

Sending a PGP-encrypted email with a verification link to activate the feature should solve that.

[westurner]

What are the disadvantages of only signing (and not encrypting the message body of) account reset emails?