I think the separate domain is a great solution in that case, but my point is that if you're worried about the use of JSONP as the transport being the insecure

I think the separate domain is a great solution in that case, but my point is that if you're worried about the use of JSONP as the transport being the insecure link, you're too late.