We initially went for email verification on user signup (for email and pass method), but we got some good feedback on why more flexibility is useful, here: #1848 (comment) .

Based on those argument, I do believe we should look into this and while keeping what we have a default, we should allow positioning email verification or even turning it off if they want.

I believe there are multiple ways we can go about this and we already have good foundation for it if I am correct, so should be quite doable.

@infomiho will probably have more to say on the topic.