I think it would be highly useful to have a successful open standard for this not controlled by a commercial third party with a financial interest in the implementation.
To the point on account recovery and its pitfalls, any argument that reduces to "System A is better because (in my opinion) those accounts are changed/deleted less often" seems like handwaving. This argument can make any proposal the winner, I myself have no hard data on account churn for any major service, although I accept that email accounts are probably higher turnover than services that introduce user lock-in ... by things like supporting a single sign-on (i.e. Facebook Connect). But WHAT IF an authentication system relied on email accounts, for example. Perhaps users would then be motivated to maintain such accounts for the purpose if it being their auth key.
Finally on the topic of recovery, many services already support the use of a mobile number for this, since these are portable. Implementing this as part of a Persona implementation would seem to address the 'I/someone else threw away my key" problem.
https://news.ycombinator.com/item?id=7243172
(By the way, I am going to try to avoid wasting even more of my life arguing on Hacker News about the benefits or lack thereof of Persona, so I am dropping these links here to maybe seed discussion among others, but I am going to attempt to avoid ruining my Christmas Eve by forcing myself to never look back at this particular thread again ;P.)
Also, for anyone wondering if I have anything credible to say on this subject before bothering to read any of this--and maybe to the one person who downvoted me from 3 points to 2 points, which I noticed as I fleshed out the "I will hopefully leave" message ;P--I have run a service with tens of millions of users that only uses federated login (though accounts are optional, so I "only" have just over ten million accounts on file), and have been staring at this space since 2001, when Microsoft announced Passport (at the time, I even was thinking of starting my own single-sign-on service, but was a naive college student ;P).
(later edit: I found another old thread on this subject that I am going to add here as an edit, mostly because any other way of adding it might cause me to see if there are any responses to this comment ;P. At the time, to this new link, there were two responses I hadn't bothered seeing and responding to: one from someone who insisted upon comparing the fundamental bug in Persona with an existing "worst practice" (as opposed to any of the better alternative options), and one who seems to be in left field assuming the value of a Facebook account is based on whether the user updated their email address: the point I was making is that Facebook isn't actually tied to email addresses, as they "understand" the problem inherent in relying on them for anything, and so users do not run into any of the issues that Persona not only doesn't solve but actually makes worse. Regardless, yeah: even without reading any comments from today I am already spending way too much time at this ;P.)
https://news.ycombinator.com/item?id=8250301