How is that different from any other crypto-in-js? In other words, Alice goes to Bob's server, Mallory serves a MITMd initial page w/o encryption (or worse, wit

How is that different from any other crypto-in-js? In other words, Alice goes to Bob's server, Mallory serves a MITMd initial page w/o encryption (or worse, with the cipher suite replaced for a weak one) to Alice, and nobody is any wiser. Cute, but impractical - makes too many assumptions, especially "yeah, let's ultimately trust the initial page load, what's the worst that could happen". You could load the initial page over HTTPS, but now you have two crypto stacks to worry about.