Better HTTP authentication scheme that's phish-proof?

My colleague Robert Sayre has proposed that a lot of phishing  
problems could be solved if better HTTP authentication was used. I  
thought that this crowd might be interested:

http://www.franklinmint.fm/blog/archives/000843.html

There's also a proof-of-concept snippet of Python in this bug for  
those who want to get their hands dirty; the Python's pretty easy to  
read, and well commented:

https://bugzilla.mozilla.org/show_bug.cgi?id=356855

cheers,
mike