Hacker News Reader

It also seems that would help with not giving out passwords to spoofing sites

The spoofing site could just pretend your U2F was valid and get your password, although it couldn't really do anything with it anyway.

The spoofing site wouldn't/shouldn't be able to pass the browser validation of the TLS server side certificate.

Why not? How hard is it to get a cert for a domain that looks like paypal-businesscenter.com?

Moreover, the browser could remember the expected shared secret based on its and the server's RSA exchange.