I don't understand why I must be identified - anyone can download this branch. I get the same prompt when I upload to launchpad - that makes far more sense to me.
Anyone know why bzr does this?
The location service used to resolve the lp: branch names does not distinguish between whether you want to read or write the branch. It will use the SSH transport if you've told it about your Launchpad account so that write access will work if needed. SSH connections require access to your SSH private key in order to authenticate to the server.
Another way to look at it is: bzr always prefers to use ssh to download branches from Launchpad, even if the branch is publicly available. (A bit like the way Launchpad always uses SSL even for public bugs.) Using SSH prevents accidental or intentional interference from other things on the network (firewalls etc) and is generally a bit faster once the connection's set up.
bzr is using a ssh-key that is stored in your keyring, the calling application would actually be ssh-agent. Your keyring has a password set so that nobody else can access that key without the password. For more information on keyrings see: my answer to this post
THe only way that i'm aware of defaulting this behavior is to generate a private/public keypair without a password.