At smaller firms, IT security training often consists of sending phishing emails, and trying to get employees to somehow navigate the (literally) dozens of TLD’s that outsourced company functions use for official company business.

I get the impression most industries are moving this way (by outsourcing everything they possibly can to *aaS).

I don’t understand why it has to be https://company.subcontractor.com, and not https://subcontractor.company.com

There’s probably a depressingly large and profitable industry waiting to be invented by the person that solves that problem.

From what I can tell, AMP email is a step in the other direction: run JS and active content as the email loads, presumably from an unauthenticated sender, and no https padlock that users already understand.