Having a 2-Step verification would be an excellent idea. I think many of us would be more comfortable if there were some sort of additional layer to their account security, I know I would. This could be implemented in several different ways such as having to add additional email or phone number where an automated system would send a code if someone would try to log in your account with different IP address or special browser cookie. Also this code could be asked and sent for every log in attempt.
Of course this could be optional so you don't need to add additional email, phone number or whatever if someone wishes so.