The idea is straightforward: I maintain a public-key whitelist. Consumers generate a key pair and send me their public key by email. That’s it.
Of course, this approach does place limits on the kinds of interactions or access patterns I can support, but in principle it works.
Still, the simplicity makes me cautious. When a solution feels this low-hanging, it tends to be one of two things: either it’s so straightforward that no one bothers to talk about it, or the pitfalls are significant enough that nobody uses it.