It's in the ballpark. "It's a second email password so that no one can listen in on your emails". The problem is implementation. Even one where your client / provider knew the private key is better than cleartext everywhere.