Making the public key of the remote available to JS wouldnt help because if you can't trust the identity of the remote server or integrity of the connection then you can't trust the javascript.
Tor hidden services are secure because of the lack of human meaningful names.