The browser already has access to all your keystrokes and all the data it's displaying to you. In some way, it's a "Man In The Middle" that sits at the UI layer and will be able to sniff anything both ways irrespective of the networking layers.
That password coming from your "secure keychain" (or any other password manager)? It is also visible "in the clear" by the browser. Only challenge-based, out-of-browser authentication methods will keep the browser from seeing your secret, but it'll still be able to snoop your interaction both ways, and make sensitive API calls on your behalf (like transferring money, etc). There are other methods like OTP that also limit the exposure of your secret, but don't protect against the main threat of hijacking an authenticated browser session.
Thankfully some services add another layer of authentication for "sensitive actions", but it's not that common, and it is often weak (for example, sending an SMS with a code). Better than nothing of course.