The signature will be for the convincing fake and won't be valid for the real site. Plus, your hardware key won't even recognize the fake site as an enrolled si

The signature will be for the convincing fake and won't be valid for the real site. Plus, your hardware key won't even recognize the fake site as an enrolled site, and won't even generate a signature for the fake site! I think that's mostly right anyways. There's a very helpful explanation somewhere upthread and that's what I understood from it.