Webauthn does cover the scenario described by associating the credentials in the hardware token with the domain name, so that you're not entering credentials in

Webauthn does cover the scenario described by associating the credentials in the hardware token with the domain name, so that you're not entering credentials into a random site or iframe; the browser and token are verifying that the URL requesting a challenge is the same as the one that generated the credentials in the first place. Showing the action as part of the dialog doesn't really solve the threat posed here, because if you're not validating where you're answering a challenge from, then you also don't really have a way to know they're not lying about the action presented.