My biggest issue with OAuth is that it trains user to enter username and password on a page that another site redirected to.

How easy would it be for a website instead of redirecting to https://login.fleamail.com instead redirects to https://login.fleamail.terriblepun.com that has a page that looks exactly like login.fleamail.com

I personally am paranoid about this and check the address and https certificate on the redirected page to make sure it is what I expected, but I am sure the average user does not do that.