Fires the exact same TransferWithAuthorization signature the road uses, with a chosen To address. Watch MetaMask: a normal signature sheet = candidate is CLEAN; the red "deceptive request" page = FLAGGED. Nothing is ever submitted — signing alone moves nothing; you can also just read the warning and cancel.