This requires me not just to absolutely trust trustfabric, but to trust that they're security is bulletproof and that their identity reclamation mechanisms such carefully engineered paragons defence in depth. Given their admittedly very clear privacy policy does not rule out selling your information in aggregate or in detail nor changing the policy without explicit notification they've fallen before the first hurdle.…
I.. agree. Them having those policies is what makes this presumably a business and not a standard. Maybe something like this is better implemented closer to how BrowserID is (or am I talking out of my rear?). Other than that, I'm intrigued.
In theory, this kind of problems was what OAuth was designed to solve - access to protect (private) resources by requesting the user's permission. In practice, I'm not sure if it's trusted enough in terms of security to be used for this. Giving access to CC or SS numbers is 'somewhat' more sensitive than letting someone post on your Twitter account.