One problem, though, is that banks and merchants tend to flag the credit-card field as "Never autocomplete, even if the user has explicitly requested otherwise."
Any tool that actually solves the problem, at least from my perspective, is going to have to give me the option to ignore whatever security conventions are built into the standard(s).
I think it is reasonable to demand not to autocomplete on the server side. Do they really demand not to autocomplete on the client side? In x-autocompletetype case, all CC information stays in the browser, only thing server does is to mark "this is CC field".
Any tool that actually solves the problem, at least from my perspective, is going to have to give me the option to ignore whatever security conventions are built into the standard(s).