Nearly all commercial services require the execution of javascript. For example, I couldn't disable javascript in my Steam browser. But in my personal browsers

Nearly all commercial services require the execution of javascript. For example, I couldn't disable javascript in my Steam browser. But in my personal browsers I have javascript execution set to temporary-whitelist-only. Much like how I don't open and execute every email attachment sent to me. Comcast's injection attacks actually don't do anything without JS being run. I am not being hyperbolic in saying that 100% of malicious attacks on the web of the type you're floating use javascript and fail without it. Personal and non-profit (non-incorporated) websites are mostly static html and files in directories and do not require everything everywhere be encrypted and verified. This "execute everything blindly" practice is only accepted because it's required for businesses which require JS execution. I reject this premise because no, it doesn't apply in all contexts and risks of MITM attacks (on personal websites) are very low once you question and mitigate it. The document web is much safer and requires less sacrifices than the application web.