It's worth keeping in mind that if you enter your password in an attacker-controlled website, you lose your entire credential, not just one malicious authentica

It's worth keeping in mind that if you enter your password in an attacker-controlled website, you lose your entire credential, not just one malicious authentication/signature using it such as here. Also, this vulnerability is very patchable; password phishing is incredibly hard to prevent.