>So it's an additional factor for authentication, not a way of identifying fraudulent sites to the user? It doesn't identify fraudulent sites (tls is the tool

>So it's an additional factor for authentication, not a way of identifying fraudulent sites to the user? It doesn't identify fraudulent sites (tls is the tool for that). but it won't give a properly signed login response for gmail.com to a request from the site fakegmail.com. That's a poorly worded answer to your question, but here are some slides I made to explain the specification: https://docs.google.com/presentation/d/1AkcTHahME5xY-FExm6vNVJwTSU_8u106S5DRjjHXFYk/edit?usp=sharing https://docs.google.com/presentation/d/1AkcTHahME5xY-FExm6vN...