[darklajid]

Wouldn't it be possible to host it on your own server, including the 3rd party files?

And wouldn't TLS in this case protect the full session?

You still have to trust the source, but - it's on your machine. Go read it if you want?

[TomasSedovic]

It would and they should do it. But the whole thing would still be fundamentally insecure. Read the link submitted by raphinou:

http://www.matasano.com/articles/javascript-cryptography/