There's still no login infrastructure, so that's all missing.
There's a mailing list signup (#175), mercifully unchecked by default (one that one might actually want to check!)
Key retrieval works kind of like password reset, but... I'm not sure that's quite so common that it would justify speccing a whole structure around this pattern.
Stray observations: