Someone suggested some sort of metadata that could be passed down to the browser to say this list of domains or such are valid. But if the website is hacked to have injected metadata put in then I kind of think that's ever worse than the current problem. It gives trust to a domain implicitly.