PGP / canary before any password field
August phishing kits still render a perfect login before showing an anti-phishing phrase.
If the page wants credentials before a canary or signed notice, leave. Checklist notes live under PGP and link verification.