Worked on something very similar and we chose not to move ahead with this kind of feature because of the phishing risk, without redefining the problem (like web

Worked on something very similar and we chose not to move ahead with this kind of feature because of the phishing risk, without redefining the problem (like webauthn, Fido etc) it is very easy to dupe a user / replay attack. Most users don’t pay that much attention and friction hurts adoption. Kind of funny the govt shipped the feature even with the spam risk and our more commercially oriented competitor product didn’t. You’d Hope they would be raising the bar for security not lowering it.