For a consumer mail service, you to need to know enough to let them recover their account, possibly with decades of un-backed-up correspondence with and photos of since-deceased friends and relatives, when they’ve forgotten their password, and without letting someone else recover their account. This is a hard problem.

(I’m expecting some idealized “solutions” from people with idealized beliefs about mass market tech skills.)

Why don't we just <incredibly naive solution that does nothing to help, but somehow also involves the blockchain>?

This is such a nasty area, with such crappy solutions (name of your first pet), that it should become a service all of its own.

i.e. when I sign up with you, I can choose my own preferred vendor to handle identity recovery.

You also need a process for resolving ownership disputes. Facebook takes the tactic of having the person claiming ownership upload government-issued ID, which seems like it would be the only foolproof way to do so, yet they're constantly maligned for it.

Most sites solve this problem with a combination of 2fA and at least one security question.

Having my phone number isn't even good 2fA.

You almost certainly need a password hash, and that’s (as I understand it) the main privacy worry related to the Yahoo breach.