[basch]

and yet, they announce a change to the login screen from a domain of workspaceupdates.googleblog.com

If I was unaware of the change, and somebody sent me a link, and I wanted more information about the change, and got sent a link to workspaceupdates.googleblog.com (without already knowing of it) I would think its a sophisticated phishing attempt. A corporation like google should really be pushing human trust through exclusive use of .google or .google.com