> Also this forces the attackers hand, an attack against this system can be detected if you want to spend the time comparing hashes. You could have an extensio

> Also this forces the attackers hand, an attack against this system can be detected if you want to spend the time comparing hashes. You could have an extension which checks the hash of the js/html payload against a publicly known and signed hash prior to running and rejects it otherwise. It's still browser crypto but potentially you do better than 'everything is broken if the ssl session is hijacked'.