I came across this issue when I was implementing an ssh client in browser (https://www.minaterm.com https://www.minaterm.com). It's absolutely correct of course

I came across this issue when I was implementing an ssh client in browser (https://www.minaterm.com https://www.minaterm.com). It's absolutely correct of course, but interesting that it's an issue in 2015. There should be a way of having the browser (outside of the JS) verify the hash/signature of a page against an external repository which would verify that this page had been independently audited. It's interesting that it's relatively easy to do this with native client software (hash/signature, manually check it), but less so with browser based applications.