If there is a response to the email the user is then approved?
That's the technique for the "interim"period, in which browserid.org will implement user control verification through an e-mailed link. For each e-mail address that you wish to use as an identifying token you'd have to prove that you control it through that mechanism, until your e-mail provider ( which may also be you ) implements BrowserID.
Unfortunately the end-state to which we are all supposed to move is to have our e-mail providers act as the Primary Identifying Authorities for us. browserid.org would then step out of the limelight and let the PIAs take on the burden of proving that the user controls the identifying token.
So though the pattern used ( client-authenticating certificates ) and the implementation ( JavaScript callback into the browser ) are different, if the Big Corps become the PIAs as the Mozilla team intends then the overall picture won't be any different to OpenID today, with the majority of people's online identities still at the mercy of a handful of companies.
Of course, as with OpenID there will always be a few geeks who act as their own PIAs. Just a few.