I think the most practical solution here is to train users not to use domain names and de-emphasize them in the UI (and URLs more generally). Which I hate as mu

I think the most practical solution here is to train users not to use domain names and de-emphasize them in the UI (and URLs more generally). Which I hate as much as anyone here, but if I'm going to give my parents advice on how not to fall for a scam, telling them "Google the name of the bank [or whatever] and click on that link" seems like the most secure path. Once security keys become ubiquitous, they should also provide some protection. But right now setting up 2FA for every site they use is impractical.