role is probably the most misused aria attribute, for example #88, #91.

Adding role=button to a div does not make it a button.
One has to script the behavior, i.e. if enter/space was pressed invoke the click handler.
Also add tabindex=0 to make it focusable.

However if one had used <button> attaching a click handler would be sufficient.

<button> is focusable/tabable by default (no need of tabindex=0), and it triggers a click event when enter/space is pressed (no need for extra keypress event listeners).

Same for link, checkbox, radio, radiogroup, textbox and the proposed password roles. There are already corresponding HTML alternatives available, and one should use them instead of just adding roles.

I guess It is better to call out (error, warn) in such situation.