Having the client page hosted at something like IPFS would solve this problem. The content of the webpage (and all its javascript references) would be the same

Having the client page hosted at something like IPFS would solve this problem. The content of the webpage (and all its javascript references) would be the same whenever you had the same address, so you could be sure the code was safe.