That's why the browser's built-in login Form could be so useful, it would have its own security context, so I, as a user can be sure that no Javascript could read that

I would happily sign up and reuse a password for a website that I didn't trust if it were as secure as described (PAKE + browser built-in login)