Hello,
I think of idea of having additional PAM module which passes login
after receiving and validating signed email (for some scenarios it
could even requires emails from many persons). Signing emails can be
done easliy in secure way and it could be also good for auditing.
Cheers,
Marek Mosiewicz