You're absolutely right that correctly configured cookies enjoy a protection that passwords don't: The browser won't send them to the wrong place, same as in We

You're absolutely right that correctly configured cookies enjoy a protection that passwords don't: The browser won't send them to the wrong place, same as in WebAuthn. On that basis I'm sure we could come up with a cookie-based scheme that solves a lot of problems, too. It wouldn't be as strong as WebAuthn (even in software -- TPMs aren't the only protection against a compromised OS, and software authenticators can still do plenty to defend themselves), but it wouldn't need to be to have enormous value.