I assumed by "outside of their services" you meant non-google people who want to send email using this. On re-read, you mean it doesn't stop anyone else building a client that can understand these actions, right? That's true.

Because just like google needs people to register for security, so do other providers.

This rapidly becomes unwieldy - how are you going to convince people to register with tons of providers? So this format is pretty much google only.

> Because just like google needs people to register for security, so do other providers.

That's probably a bad assumption, once you have more than a few parties using this system. I'd be surprised if even Google used the current, apparently manually-reviewed, registration system for long rather than as a short-term measure before moving to a less cumbersome accountability mechanism (and this is more "accountability" than "security".) But even if multiple parties were using that kind of method, there's a clear incentive -- especially for the players that aren't Google, but even Google has some incentive -- to build a facility where a shared registration application can be automatically distributed to multiple parties.