At least today you still have to trust the JavaScript the server sends you. I have heard talk in the past about adding code signing to browsers. Combined with

At least today you still have to trust the JavaScript the server sends you. I have heard talk in the past about adding code signing to browsers. Combined with open-source code and a security audit this could potentially offer something approaching the security of a traditional application.