[mpolichette]

I don't agree... I think browsers are not the weak link here. I'll agree they have a large attack surface, but the communication channel needs to be secure regardless of what client receives it.

> the most an attacker can do is to change the content.

Sure , but I would argue, depending on on the content, that malicious content can be just as bad as malicious code. Just ask anyone who has been phished.