I don't think there is a way around "displaying that purpose on the trusted 2FA device." if you want to protect against a compromised computer. Domain binding

I don't think there is a way around "displaying that purpose on the trusted 2FA device." if you want to protect against a compromised computer. Domain binding protects you from fishing, but still relies on the user's computer, including the browser, being secure. So it doesn't help here.