It seems like what we need is code signing for web pages and their assets. If you sign the app, you still have to trust the people making it, but you don't have

It seems like what we need is code signing for web pages and their assets. If you sign the app, you still have to trust the people making it, but you don't have to trust the server it comes from. This puts you in no worse of a position than an update to your non-web mail client. And if a web site suddenly switches to a new public key, the browser should do the same kind of thing as it does for expired SSL. It should be relatively easy to create a browser extension that does this in the meantime. Then what I'd like to see is a mail service that sends its source unminified, and then publishes the same code (with signature) on its server. That way you could easily verify that you were getting the canonical version of the code (and not a special compromised version that an attacker inserted for users on a special list), and anyone could look and see if it was doing something fishy (or broken).