A provider requires authentication of the initiator's identity.

How can a provider verify the claimed identity of a consumer in the absence of a certificate authority?

The provider sends a message with unique data to the address supplied by the consumer. The consumer has to pass the unique data back to service provider to complete the authentication.