I think you just hit on a major issue that merchants face when it comes to the PCI DSS. Many merchants have been wrestling with the scope of PCI DSS compliance

I think you just hit on a major issue that merchants face when it comes to the PCI DSS. Many merchants have been wrestling with the scope of PCI DSS compliance for years. They are looking for easy solutions where unfortunately there are very few. The PCI council has done a very respectable job of creating compliance guides and standards documentation. However, when it comes to implementation merchants struggle with scope. If a merchant server as an example responds with a reference to the stripe.js & that code is then executed within the browser context of the merchant domain, is that merchant server in scope for that component? I believe it is and every QSA (PCI qualified security assessor) I've had this same conversation with has come to that exact same conclusion. If Stripe consults with their QSA and they come to a different conclusion, then I would hope Stripe would share that publicly with the community. That would certainly be a ground breaking event for those of us who deal with PCI DSS on a daily basis. In terms of accusation, my goal here is to ensure that Stripe.com and others who are working in this space are being as clear as possible with their communication, that's it. Stripe is going to address statements like the one I pointed out on their site & hopefully as an industry we can get to a point where everyone is a bit more clear on what falls in and out of PCI DSS scope.