Like everybody else has already said, what you've described is pretty much how PKI / private-cert login works already. If you take out the part about needing a trusted issuer -- that is, if you don't need a 3rd party to verify that *this* cert belongs to *this* user -- then it becomes free, *and*, like you asked for, every major browser (plus every major HTTPS connection provider in every major programming language, let's not forget!) already supports it. Want to change the world? Make a 2-click certificate generator for all the major platforms (simple wrapper around command-line openssl), tell people how to import them into the browser, then add support for cert-based login to SE.

So I just spent a few minutes looking for it without success, but I feel *sure* Jakob Nielsen wrote an Alertbox article about how modern machines have no excuse for "are you sure" prompts when we have all the makings needed for unlimited "undo" of any action. The gist was that if you pop up a confirmation dialog when the user tries to e.g. delete a file, all you train them to do is mentally map the "delete" action to "hit the delete key, then the enter key", buying yourself nothing. It's a bit like Jeff's own post here. I would contend that the Anti-Fitt's Law is a lot less important than universal Undo. The Gmail thing should leave Labs and be a default-on option for everybody. If I hit Send accidentally, give me 5-10 seconds to say "Undo". If I "delete all" in my word processor, give me robust Undo. If I hit the ejector seat, a pleasant voice should tell me I will eject in 5 seconds unless I hit the NO WAIT ONLY KIDDING button.

Don't forget that if you swing that way, a number of the more popular netbooks are becoming popular in the hackintosh community. If you get one that sports Ion, you could even manage fancy desktop effects without breaking a sweat, and it's about a quarter the price of an official Air.