> That's the thing - you don't actually have to trust the servers to the same extent. You can look at and verify any JavaScript and CSS and HTML that the server

> That's the thing - you don't actually have to trust the servers to the same extent. You can look at and verify any JavaScript and CSS and HTML that the server's sending you, manually if necessary, but there's absolutely no way of telling what code the remote server is running. You can verify the JS, CSS and HTML only for a specific request and only if you have sufficient knowledge, meaning you have studied cryptography and even then it will take a lot of time because it is not possible to not verify that code manually. This offers no additional security at all for anyone but the most paranoid cryptography experts.