That's pretty slick! (Let's assume that the PRNG in-browser issue is resolved.) Setting far-future expires/forcing long-term caching can help. Even LocalStorage

That's pretty slick! (Let's assume that the PRNG in-browser issue is resolved.) Setting far-future expires/forcing long-term caching can help. Even LocalStorage for code can help. Of course, it's still chicken and egg -- and anything can be updated or disabled on the fly w/ HTML anyway at next load. Any of the injection or MITM issues that arise w/ in-browser crypto are similar to those in mobile apps or browser extensions as well, except that you have the chance to modify the app more often, so sticking your crypto code in an app or browser extension is no panacea anyway. Maybe you could combine this concept with http://headjs.com/ http://headjs.com/. It's a great idea.