To use Bitcoin-OTC, after registering, I just have to authenticate myself by hashing a string with my private key and sending back the output. Bitcoin-OTC will then recognize me because only someone with my unique private key could have created such an output from the initial string. Couldn't other web services do the same, like say, Mt. Gox? Do they not do so because of technical reasons, or is GPG just too hard for some people?