I'd love to do (b)/(c) plus (d) in the following way:

Default is to force users to authenticate, because it's expected and safe behaviour.
There's an option in account settings that you can select that basically says "send me insecure emails that I can reply in/to; and I understand that if I forward them, someone else can reply as if they're me".

Then I can use my phone to reply to emails, without firing up my browser.