For extra security, the website should generate an extra nonce to go with the current time, otherwise there's a window where the signature could be reused to login again (maybe to another site).
I understand replay attacks. I don't allow that to happen.