Comment by xg15

I guess "100% secure against phising" is incompatible with "the user can in any way access the key" because if you knew the key, in theory some super-convincing phishing site could get you to spill it.

I still think the real reason is lock-in, but I could imagine this is their official justification.