Idk about all clients, maybe just specific services. It doesn't always have to be built into the protocol.
Absolutely. All web clients should have a built in bunker with email and password reset IMO. nostr:nprofile1qqsx8lnrrrw9skpulctgzruxm5y7rzlaw64tcf9qpqww9pt0xvzsfmgprfmhxue69uhhq7tjv9kkjepwve5kzar2v9nzucm0d5hsz9thwden5te0wfjkccte9ejxzmt4wvhxjme0qyvhwumn8ghj7un9d3shjtnndehhyapwwdhkx6tpdshssfnq7m and I discussed ways build this back in Prague. It's really needed for the masses.
Discussion
Sure. It doesn't need to be all clients. Only those that want average people using their services.