> Too bad the spec is stupid and requires password managers to be identifiable so servers can deny the "insecure ones".

There is no requirement that credential managers identify themselves. Please stop spreading misinformation.