Malicious website that looks like your bank can't get you to tell it your passkey, but you can type in your password.

(WebAuth checks the domain before signing)