Challenge-response hashing in JS is MitMable and likely to have implementation errors. SSL has defenses against MitM attacks, and is implemented in very widely

Challenge-response hashing in JS is MitMable and likely to have implementation errors. SSL has defenses against MitM attacks, and is implemented in very widely-deployed libraries, so if there's an implementation error you'll hear about it before it's used on you. The drawback is of course that you need to have a signed key. That is the price you pay for MitM resistance. We're not supposed to use self-signed keys (which are free), even though they are strictly better than JS challenge/response hashing.