Double stepping is fundamentally weaker from a security perspective. The phisher can present you the username screen, use it to fetch your correct image from Go

Double stepping is fundamentally weaker from a security perspective. The phisher can present you the username screen, use it to fetch your correct image from Google, and present the image to you. This proposal is better in the sense that the correct image is cached locally and protected by the browser's local storage origin policy.