Maybe you trust the server to serve legit JS (or have some other mechanism to ensure it, like content addressing e.g. IPFS) but you don't trust the server not to leak/log your info by mistake if it was processed in the server.
I think the original question is, how is that different to TLS? It seems exactly the same to me.
(Where did you load minibone from in an ipfs context? Couldn’t that same endpoint just perform the encryption?)