[7ewis]

Is this similar to how hardware wallets show the true addresses on their displays?

[bawolff]

Webauth checks the http origin so it only gives the code to the correct website, taking the human out of the decision loop.

[Avamander]

It's very vaguely similar to TLS connections with mutual authentication, you can't normally MITM/proxy it.