Is it ASCII or Protobuf? The importance of types in cryptographic signatures
That's a fairly big problem I hadn't read about before, with great writing. But I don't think the proposed solutions are realistic.  [...] all those web sites must use exactly the same format for 
  authentication challenges.

  [...] the key cannot be used for any automated purpose [...]

  [...]  all applications which use the key for signing must include
  such a context string, and context strings must be chosen to avoid conflicts.

  [...] better than either of the above is to use a different key for each purpose.

That's shifting protocol problems to standardization and human caution. It may work, but I'm skeptic.Maybe a change in the cryptographic protocol can fix the problem? For example, instead of    Server: server_value // domain + action + nonce + ...
    Client: sign(server_value)

we use    Server: server_value
    Client: sign(client_random) + sign(server_value XOR client_random)

and the server verifies that the two signed components, when XOR'd, result in the same value sent. This way the client only signs random data but can still authenticate.This is not supposed to be a final solution, and is likely to have flaws, but I think it's a better direction to pursue.