Exactly. That's why I'm advocating for a signed JavaScript/HTML/webapp standard of some sort.