Putting my security hat on, why are you worried about the host being the attack vector more than in transit? The host could easily alter the javascript that is

Putting my security hat on, why are you worried about the host being the attack vector more than in transit? The host could easily alter the javascript that is sent back to sniff the crypto token.