What if you host the javascript separately to the dynamic content (say on S3)? This would give users some protection against compromised servers. This is akin

What if you host the javascript separately to the dynamic content (say on S3)? This would give users some protection against compromised servers. This is akin to having an app supplied from a trusted source (ITunes) and then accessing an API through client side encryption.