SiteKey is also trivially vulnerable to the attack known as "I bet you didn't remember that this page should show you a SiteKey."