Having to log in to a half-maintained, slow web portal with terrible UI that is down 25% of the time is a really terrible way to get your sensitive and often important documents.
But, a potential sender with important messages still needs do some pre-flight email verification over this path, e.g. sending a verification code encrypted the same way, to validate that the intended user can read it and send it back via another authenticated channel. This ensures that the sender-specific user identity actually possesses control of that email address and the discovered private key. It also reduces the impact of a malicious email provider to only denial-of-service rather than content interception.
So, is that discovery protocol worth it, versus just having an opt-in setting where the user supplies their desired public key and email address in the same form?