Yeah, pretty nice. Although it auto linked my email account, could there be an attack vector based on non-unique names?

yeah, it doesn't actually use email at all, even though that is part of how the auth system in gitea works. i'm not sure how it picked up an email but i think it searches for your kind 0 to find the username to use. it may have something to do with your initial setup of gitea. each pubkey is a distinct identity, so that makes sense. if there is anyhting you think of to improve it (eg, i felt like the prompt to auth is redundant on the in between screen, it should just ask for the pubkey and challenge and sign and log in if it passes. anyway, i love that thing. makes collaboration on gitea so smooth.

i think it has a countermeasure against same usernames also, probably a counter increment.