We clearly need at least 2 levels of opt-in, the hardest core one should probably be via verification only. Something roughly analogous to what vitaminj just outlined, I wish it was implemented by now, it should be piss-easy.