I don't dispute the technology exists - I dispute that this technology can be deployed on a web app to general users effectively. I don't believe that is currently possible in production effectively in a way that neutralizes my arguments that an attacker could just change the JavaScript to record passwords somewhere.

That's why the browser's built-in login Form could be so useful, it would have its own security context, so I, as a user can be sure that no Javascript could read that

I would happily sign up and reuse a password for a website that I didn't trust if it were as secure as described (PAKE + browser built-in login)

I'm really not sure what you are disputing here. PAKEs are for preventing man in the middle attacks, not for securing a local program or preventing malicious code from running in the browser. No one is advocating, use a PAKE and all your problems are gone - it's about addressing key exchange over the wire and eliminating an entire class of attack. Password managers are a tough subject - they are like coffee . Yes, there may be small amounts of toxic stuff in it, but that is offset by a factor of 10,000 by the number of people who do not get in a wreck on the way to work, thanks to being awake and aware form 70mg of caffeine.