Sure, if the site is compromised than nothing you could know. But this is kind of unlikely in case of major players like banks.

Zero knowledge web app - is nice theoretical approach but I don't see a way it will be adopted anytime soon.

As to mine claims, I will post application when it will be ready, and we could discuss attacks against of it. It will be quite different from clipperz etc.