This is essentially client side TLS, which browsers cut because the ux was bad? Only now you can backdoor/mitm/typosquat a website, rather than attack the major browsers or the os?

And as I understand it, there's no way to verify you're talking to the right person, so sharing a secret via signal is strictly better?

Share the URLs via Signal, then you have a validated identity, and the secret won't pop up in your notifications or be retained in your chat history.