An attacker can just remove the <script>-tag that points to the HTTS-served verifier. In general: If the site the user visits is plain HTTP then there's no way

An attacker can just remove the <script>-tag that points to the HTTS-served verifier. In general: If the site the user visits is plain HTTP then there's no way to trust the site.