Sounds exactly like the system we used in Belgium.

I don't think the system you explain is bad. It's essentially PKI.

My issues are deliverability: what if I get the email and never open it? What if it gets marked as spam?

And it requires me to read emails, something I've actually tried to reduce because every subject is screaming for attention.