Ok, I think I have almost everything figured out now. Let's see if I can explain it.
The client will create a new profile. During this creation process, an RSA public/private key pair will be generated. The public key will be uploaded to the master server. The private key will be encrypted with the user's password and uploaded to the master server as well as saved locally to the users hard drive. A hashed copy of the user's password will also be stored on the master server for web logins to manage clans and other future features.
The user must supply an email address, which will be used to send a random activation number. An account must be activated in order to use it. This is so people don't create lots of bogus accounts and so that there will be an email address to send a reset password to.
There will be an option to remember a password so you don't have to type it in every time you play. This password will be encrypted with unique information about your computer as a key, so if somebody copies your profile file, they won't have easy access to your password. This is only really a concern for something like LAN parties where you might be copying games or something between friends.
When a client connects to a game server, the game server contacts the master server and obtains the client's public key. The game server encrypts a random string using the client's public key, then sends it to the client. The client decrypts the string with its private key, and sends it back to the server. If the strings match, the client is validated and can play using that name. If not, the player is kicked.
In the event that a user forgets his password, a reset password code can be sent to his email address. This code, when used, will allow the user to generate a new public/private key pair and pick a new password.
Clan tags are going to be a bit tricky. I could make them separate, like Battlefield 2 does, but that would mean somebody could incorporate a tag into their name and get away with it. For example, if there was a clan called "[TAG]" and a player called "Name", using "[TAG]" for the tag and "Name" for the name, somebody else could come along and create a name called "[TAG]Name", with no clan tag, and it would appear the same visually. I guess what I'll have to do is keep the clan tag part of the player name, like it is now, and scan the player name for each existing clan tag, then ensure that the player that logged in is legitimately part of that clan.
I think that covers the basics. Let me know if you see any potential problems with this design.
