Comment by yuliyp

This feels very broken:

- The suggestion of signing the timestamp means that any web site you log into with this can log in as you to any other web site you log in to

- Given that there's no namespacing of the signed messages, users can be easily phished into providing a response to a challenge posed by a different web site

- It's not obvious what advantages this has over using client cert authentication with TLS, and it has many downsides.