How does this handle people changing their emails? Can you do the same thing with a cryptographic signing key or something, instead? It seems like this could be implemented in a way where I prove control over the signing key (by signing a challenge, for instance), but I don't have to reveal anything about my identity besides "I have access to this key" if I don't want to.

(If you're worried about not just servers changing but clients changing, and needing to get the key over, there are protocols for efficiently and securely transferring information between client computers, using a very short password that doesn't need to be kept private after the transaction. magic-wormhole implements this sort of thing.)

This may or may not apply to your site, but, in general I don't want other users of a website to be able to PM/email me unless I specifically authorize them to. Requiring that my email is public does not provide me this control. You can do what HN (which doesn't implement PMs) does and let people have an optional public profile, where they can list a way they want to be contacted by other users if they want.