[slig]

Yes, and you can trust your ISP and/or VPN and you have no way to tell if the origin web server is compromised and is serving malicious JS. HTTPS or not.