If you register for a site where the connection is safe, then go to a dangerous place, this method has an advantage over a password even during MITM attack.
The attacker can't imitate you because the site has your public key already.
The attacker can't imitate you because the site has your public key already.
The point I'm trying to make is that if you can trust SSL to protect a BitAuth signature, you can also trust it to protect a password. So claiming "passwords may travel over plaintext" as a relative advantage of this scheme is disingenuous; in both cases, you need to provide that protection at a lower protocol level.
And if all authentication is done client-side with javascript, the attacker could steal your private key and use it to attack other sites.