[buboard]

> They can't inject anything into the page

assuming that someone finds a way to sign a malicious Html page (e.g. by sneaking into the editors office) they can serve it from anywhere, and the browser will pretend it's coming from the bank

[echeese]

If someone's able to get the signing key you've already failed at security.