Because my passwords for google.com, gmail.com, youtube.com, and google.co.uk are exactly the same, and the browser has no way of knowing that that's okay.
(Google specifically has probably rerouted everything through google.com these days, but the general problem exists.)
The also require the server to provide a list of Origins that are valid for the protocol, if the domain your logging into is not in the list, the challenge of the server will not be signed. Its called AppID in the protocol.
(Google specifically has probably rerouted everything through google.com these days, but the general problem exists.)