On: OpenPGPjs has passed an independent security audit

[tlrobinson]

That’s a start, but if the main resource (the HTML page) can be modified it doesn’t help.

If you could require the root page be cryptographically signed (but by who?) and optionally prompted for updates then we’re talking.