Comment by mr_mitm

The phisher will not receive a valid token, though, because you sign something that contains the domain you are authenticating to.