The same server(s) also control the JavaScript code run by the client/browser. They could serve special code (to any one the government wanted to spy on) that returned their password to the server.