I have prototyped this sort of thing, but have not yet put it into the trunk. 
There are a few issues around permissions. It is most straightforward to simply 
put a /fantasm/fsm/MyMachine/?... url into an email, but then only developers 
can respond to email links. Supporting things like eta/timeout etc. requires 
some additional infrastructure.

Would a simple developer-only email suffice in the short term?

Here's another possibility:

states:
  - name: s1
    action: s1_action
    transitions:
      - event: ok
        to: s2
        async: true # tells Fantasm not to require an event from the action
  - name: s2
    ...

def s1_action(self, context, obj):
  async_token = self.get_async_token('ok')
  send_custom_email_with_custom_link_that_links_to_handler_below_and_passes_async_token(async_token)
  return null
  # fantasm would do whatever it needed to do to pause the machine - e.g., a pull queue

...

def some_custom_non_fantasm_handler(request):
  # custom validation/authorization here
  async_token = request.params['token']
  fantasm.continue_machine(async_token)
  # fantasm would reinflate and invoke the machine


The developer could possibly get async tokens for a number of transitions, so 
that they could put many different links in the email and let the user choose 
the transition ("ok", "cancel", etc.). Using this technique, the email, text 
message (or whatever) would be completely customizable by the developer.

We also need to make sure a link can only be clicked once - we don't want 
copies of the machine running at the same time. fantasm.continue_machine(...) 
could take care of that i guess. How do you see the pull-queue being used in 
pausing the machine? I would have thought the existing fan-in serialization 
would suffice.

You're right - a pull queue wouldn't be appropriate here. I'm just looking for 
any excuse to use them!

What is the status of this ?

It looks interesting, but I'd like to include some manual step where a user 
should enter data.

Nothing currently under development, but your post has given me a chance to 
think some more about this would be implemented....