That would secure the channel and the website would be able to trust that whoever is clicking the reset link is the owner of the key.
It would also be a nice second factor. You have to have access to the email account and to the private PGP key. And it is a second factor I can fully control, unlike SMS. And it's simple and cheap for the service.
My normal login only needs to see about 10 days of email, I could re-auth or use a bigger PW to get into the whole archive.
Isn't this implementation kind of a really basic idea of what mozialla persona was getting at? https://wiki.mozilla.org/Identity/Persona_Shutdown_Guideline...
This relies on email, which is highly secure, smtp is not spoof-able, server and mail origins are traceable and verifiable and there is no way to intercept the message on a malicious router/switch whatever. Ow wait ...
With almost all current systems the place security really needs to happen is at the email provider. If you can hijack/intercept a users email or hack their account then it's game over with a password anyway, thanks to password resets being (almost) universally done over that channel.
There's an argument that this is no bad thing as security focused email providers could potentially provide very secure access as part of their core business (unlike a startup just trying to get going).
But there's still something bugging me about this implementation I can't put my finger on.