I don't really get what you're getting at.
"The support document, provisioning page and authentication page must all be available over HTTPS, and the server's SSL certificate must be certified by a trusted CA whose certificate is in the standard Mozilla certificate bundle."
I suspect you're still stuck in the "users will just use somebody else as their identify provider" trap. We've seen where that leads - it gave us Hotmail, GMail, Facebook, G+, "MS passport", and the like. Persona, on the other hand, correctly allows anybody to host their own identity - iff you can pay for it.
"millions of users"
Stop with the narrow thinking - that's not the only use-case for encryption, as the internet is not a many-to-one medium like TV. The personal website I put up for my friends should be encrypted, just like everything else we send over the net.
And if you can't use HTTPS, nothing on your site is secure, so fussing over which authentication system you're going to critically compromise seems a bit academic.
A domain is free, if it's delegated. It's also something many people already have.
StartSSL is not an option (had problems with them pre-openssl-mess; absolutely not an option now).
This stuff misses the point, though: REAL privacy (not relying on a 3rd party like facebook) is a selling point that is becoming more popular "post-snowden". While I assume technical challenges can be made point-and-click easy over time, requiring cash is a hurdle that will shut out MANY people. Evidence: free email vs minor-fee/year email.
Right now, any competing service is already up against the hurdle of trying to get people to switch from what they currently use (facebook, google). The idea of not being tide to a big company is enough to overcome that hurdle, for at least some people. Requiring cash scraps that window of opportunity, sometimes for actual cash-availability reasons, and others for perceived reasons.
I don't see how they're worse than no security at all, which is the alternative you appear to be proposing.
Except one thing: it requires cash (SSL cert[1]) you're stuck with the google/facebook/etc-style situation of having to rely on a 3rd party to maintain your identity.
It's not a popular opinion here where most people have well-paying tech jobs, but real identity and privacy on the net is something the retired, disabled, unemployed, single-parent, and other poor people need as well. Without solving this problem fist, you are simply incentivizing the current status quo and dooming any new scheme to fail.
[1] No, that SSL cert is not "cheap" when you have to live on SSDI that doesn't even cover rent/food/etc fully. The domain itself is less expensive, and can be sub-delegated between a few people.