Very true, however, most users are willing to download such things as native programs (e.g. installing web browsers) from unauthenticated sources over unencrypt

Very true, however, most users are willing to download such things as native programs (e.g. installing web browsers) from unauthenticated sources over unencrypted connections. If you are in a position to inject .js resources, then the user's security would be compromised anyway. EDIT: SRP is going to be integrated into TLS soon anyway, so we might as well hold our breath for that.