Unless the attacker has access to the server for a period of time, in which case they just replace the JS with their own code. Seems like there should be a way

Unless the attacker has access to the server for a period of time, in which case they just replace the JS with their own code. Seems like there should be a way to sign the JS offline (away from the server) and prevent that, but I don't think there's any browser mechanism for that. I think that would be neat though.