I run a product using email verification that's currently failing in all the ways on the list

I chose it because it's less complex than oauth, and (slightly, in theory) more convenient than user-password.

My wishlist version of oauth is for a slightly different protocol that 1) doesn't require the product to create an account with the id provider, 2) doesn't allow the id provider to block sites, 3) doesn't let the id provider see where the user is logging in