I've had a few days to think about this.

Now, having seen some of the alternative systems suggested, I think I agree.

I instinctively do not want to give my password to anyone. And that's a great habit to get into, and we want regular people to get into that habit. That would make phishing less useful.

In this case it seems they're trying really hard to protect your domain from harm. But yes, I've been mostly persuaded.