How is this part being done? How are Alice and Bob talking to each other at this point?
Most of this scenario doesn’t really seem to be IPFS specific. Really you’re using email as the trusted channel for public key exchange/“authentication”, which maybe isn’t the best way for trusted public key exchange.