Is there a way for a person to remotely and irrefutably demonstrate ownership of a Gmail email address? I've considered using DKIM signatures, but this has problems:
I've also considered using Google's OpenID or OAuth APIs, but I believe you can list other emails as your primary address in your Google account. Notably, the Google docs state: "The user's email address. This may not be unique and is not suitable for use as a primary key." While the API does report if the email is verified, it is not clear to me if verification is any more substantial than a simple email loop. https://developers.google.com/identity/protocols/OpenIDConnect
I understand that there are very good reasons for Google to make it difficult to link emails to user accounts. However, it would be nice if a user could opt-into demonstrating this association.
Edit for clarification: The context here is one of signing PGP keys or granting S/MIME certificates linked to the email. You want to be sure that the certificate you are signing was sent from someone with bonafide send/recv privileges, and not someone who forges a "from:" field, or who sits in the path between the signer's email provider and Google (the signee's email provider). Here, real-life identity doesn't matter. I don't care who someone is. I only care that the person making the request is also the person who has the username/password of the the claimed email account (or, I suppose, works for Google...). The purpose here is to bootstrap more secure forms of communication.
The argument here is that the standard email loop is insufficient. Email is prone to forgery and interception. But, there may be secure out of channel methods (E.g. OAuth or posting a public key to Google+). If nothing else, such an approach would provide additional evidence beyond the already ubiquitous email loop. Unfortunately, neither OAuth, nor Google+, nor YouTube comments, etc. can be reliably linked to an email address.