> A user may make a typo in the email, and that email might still be a valid email know to work (but for another, unrelated person).
That won't verify. The issuer should check if the request has valid session cookies for the e-mail-address that should be verified. This also implies that it just won't work for any service that uses sessions with a short timeout.
5W while browsing is already less efficiënt than my old laptop with a Zen 2 CPU (and most of the power is consumed by the display). Newer CPU's or SoC's should do quite a bit better than that.
That won't verify. The issuer should check if the request has valid session cookies for the e-mail-address that should be verified. This also implies that it just won't work for any service that uses sessions with a short timeout.