Not having to trust a website with my credit card details is one of the main reasons I tend to use PayPal at all, and it's something they're actively advertising with [1]. I understand it's hard to find a solution that offers both good UX and security. Maybe they could have at least added a link to open the login in a new window on their domain for users who want to easily verify it's legit. Still, I think it's pretty irresponsible to teach users that entering login credentials on (essentially) a third-party website is okay.
There is a way to do this securely whilst improving the user experience. The merchant site can run PayPal's js, which would check whether the user is signed in to PayPal. If they are signed in, the js could just display a "confirm payment" button rather than requesting credentials from the user. If they're not signed in, it could just ask the user to sign in to PayPal in a new window, where the user can verify via the browser's address bar whether they are signing into the real PayPal.
Google Wallet for Digital Goods (which Google is retiring soon) does this, and I think it is the best payment user experience that has been made, so far.
Ah, but part of the point of paying for something via paypal is that I _don't_ need to trust the website with my credit card information, I only need to trust paypal.
There isn't a way to solve this issue without hurting the user experience. For some websites, that's a fair trade off.
Maybe a browser could put in a "Verify iframes" button that would show you the payment form is actually coming from PayPal.